[Oilpan] Add HeapObjectHeader::gcGeneration() and related methods

third_party/WebKit/Source/platform/heap/HeapPage.h

Index: third_party/WebKit/Source/platform/heap/HeapPage.h
diff --git a/third_party/WebKit/Source/platform/heap/HeapPage.h b/third_party/WebKit/Source/platform/heap/HeapPage.h
index e1f17dea22cd8dd78930fcde1bad120963e296f5..647642b53cbe279f380982bdd02786e31cefc45f 100644
--- a/third_party/WebKit/Source/platform/heap/HeapPage.h
+++ b/third_party/WebKit/Source/platform/heap/HeapPage.h
@@ -172,6 +172,7 @@ public:
     {
 #if ENABLE(ASSERT)
         m_magic = magic;
+        putGcGeneration();
 #endif
         // sizeof(HeapObjectHeader) must be equal to or smaller than
         // allocationGranurarity, because HeapObjectHeader is used as a header
@@ -216,6 +217,10 @@ public:
     // object allocated here, but it was freed because nobody marked it during
     // GC.
     void zapMagic();
+
+    void putGcGeneration();

[sof, 2015/11/10 16:09:24]

What does this give you beyond what magic values already provide?

[peria, 2015/11/10 16:45:01]

They do same works to check an object is alive or not.
In addition, gcGeneration is expected to check a pointer handle (Member<>)
points a new different object on the same address.

For example,
```
UntracedMember<A> a(new A);
Heap::collectGarbage();  // GC collects 'a'
UntracedMember<A> b(new A);
a->foo();
```
In this code, it is expected that `a->foo()` crashes with use-after-free.
However, if 'b' is allocated on the same address with 'a', it goes successfully
as if there are no issue in it.
We expect that we can detect such use-after-free with gcGeneration,
which was impossible with zapMagic.

+    void clearGcGeneration();
+    uint16_t gcGeneration() const { return m_gcGeneration; }
 #endif
 
     void finalize(Address, size_t);
@@ -228,6 +233,7 @@ private:
     uint32_t m_encoded;
 #if ENABLE(ASSERT)
     uint16_t m_magic;
+    uint16_t m_gcGeneration;
 #endif
 
     // In 64 bit architectures, we intentionally add 4 byte padding immediately
@@ -258,6 +264,7 @@ public:
 #if ENABLE(ASSERT)
         ASSERT(size >= sizeof(HeapObjectHeader));
         zapMagic();
+        clearGcGeneration();
 #endif
     }