Remove asserts inserted to diagnose bug 537922

third_party/WebKit/Source/platform/heap/HeapPage.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 906 matching lines @@
     // cycle or coalescing. This is helpful to detect use-after-free errors
     // that could be caused by lazy sweeping etc.
     size_t allowedCount = 0;
     size_t forbiddenCount = 0;
     for (size_t i = sizeof(FreeListEntry); i < size; i++) {
         if (address[i] == reuseAllowedZapValue) {
             allowedCount++;
         } else if (address[i] == reuseForbiddenZapValue) {
             forbiddenCount++;
         } else {
-            // TODO(haraken): Remove these assertions once bug 537922 is fixed.
-            HeapObjectHeader* header = reinterpret_cast<HeapObjectHeader*>(&address[i]);
-            ASSERT(header->checkHeader());
-            if (header->isPromptlyFreed())
-                ASSERT_NOT_REACHED();
-            else if (header->isFree())
-                ASSERT_NOT_REACHED();
-            else if (header->isDead())
-                ASSERT_NOT_REACHED();
-            else if (header->isMarked())
-                ASSERT_NOT_REACHED();
             ASSERT_NOT_REACHED();
         }
     }
     size_t entryCount = size - sizeof(FreeListEntry);
     if (forbiddenCount == entryCount) {
         // If all values in the memory region are reuseForbiddenZapValue,
         // we flip them to reuseAllowedZapValue. This allows the next
         // addToFreeList() to add the memory region to the free list
         // (unless someone concatenates the memory region with another memory
         // region that contains reuseForbiddenZapValue.)
@@ skipping 618 matching lines @@
 
     m_hasEntries = true;
     size_t index = hash(address);
     ASSERT(!(index & 1));
     Address cachePage = roundToBlinkPageStart(address);
     m_entries[index + 1] = m_entries[index];
     m_entries[index] = cachePage;
 }
 
 } // namespace blink