[Oilpan] [NOCOMMIT] Add verifier in Member<> to detect use-after-free of on-heap objects.

third_party/WebKit/Source/platform/heap/GarbageCollected.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef GarbageCollected_h
 #define GarbageCollected_h
 
 #include "platform/heap/ThreadState.h"
 #include "wtf/Allocator.h"
 #include "wtf/Assertions.h"
@@ skipping 110 matching lines @@
 // compute the object header addr statically, this dynamic dispatch is not used.
 class PLATFORM_EXPORT GarbageCollectedMixin {
     IS_GARBAGE_COLLECTED_TYPE();
 public:
     typedef int IsGarbageCollectedMixinMarker;
     virtual void adjustAndMark(Visitor*) const = 0;
     virtual void trace(Visitor*) { }
     virtual void adjustAndMark(InlinedGlobalMarkingVisitor) const = 0;
     virtual void trace(InlinedGlobalMarkingVisitor);
     virtual bool isHeapObjectAlive() const = 0;
+    virtual HeapObjectHeader* heapObjectHeader() const = 0;
 };
 
 #define DEFINE_GARBAGE_COLLECTED_MIXIN_METHODS(VISITOR, TYPE)           \
     public:                                                             \
     void adjustAndMark(VISITOR visitor) const override                  \
     {                                                                   \
         typedef WTF::IsSubclassOfTemplate<typename WTF::RemoveConst<TYPE>::Type, blink::GarbageCollected> IsSubclassOfGarbageCollected; \
         static_assert(IsSubclassOfGarbageCollected::value, "only garbage collected objects can have garbage collected mixins"); \
         if (TraceEagerlyTrait<TYPE>::value) {                           \
             if (visitor->ensureMarked(static_cast<const TYPE*>(this)))  \
@@ skipping 57 matching lines @@
 // runs.
 #define USING_GARBAGE_COLLECTED_MIXIN(TYPE)                             \
     DEFINE_GARBAGE_COLLECTED_MIXIN_METHODS(blink::Visitor*, TYPE)       \
     DEFINE_GARBAGE_COLLECTED_MIXIN_METHODS(blink::InlinedGlobalMarkingVisitor, TYPE) \
     DEFINE_GARBAGE_COLLECTED_MIXIN_CONSTRUCTOR_MARKER(TYPE)             \
 public:                                                                 \
     bool isHeapObjectAlive() const override                             \
     {                                                                   \
         return Heap::isHeapObjectAlive(this);                           \
     }                                                                   \
+    HeapObjectHeader* heapObjectHeader() const override                 \
+    {                                                                   \
+        return HeapObjectHeader::fromPayload(this);                     \
+    }                                                                   \
 private:
 
 #if ENABLE(OILPAN)
 #define WILL_BE_USING_GARBAGE_COLLECTED_MIXIN(TYPE) USING_GARBAGE_COLLECTED_MIXIN(TYPE)
 #else
 #define WILL_BE_USING_GARBAGE_COLLECTED_MIXIN(TYPE)
 #endif
 
 // An empty class with a constructor that's arranged invoked when all derived constructors
 // of a mixin instance have completed and it is safe to allow GCs again. See
@@ skipping 169 matching lines @@
     template<typename U, size_t sz = sizeof(U)> static TrueType isSizeofKnown(U*);
     static FalseType isSizeofKnown(...);
     static T& t;
 public:
     static const bool value = sizeof(TrueType) == sizeof(isSizeofKnown(&t));
 };
 
 } // namespace blink
 
 #endif