Experiment: assert for stack-allocated GarbageCollected<>s.

third_party/WebKit/Source/platform/heap/Heap.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 17 matching lines @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef Heap_h
 #define Heap_h
 
 #include "platform/PlatformExport.h"
 #include "platform/heap/GCInfo.h"
 #include "platform/heap/HeapPage.h"
 #include "platform/heap/PageMemory.h"
+#include "platform/heap/StackFrameDepth.h"
 #include "platform/heap/ThreadState.h"
 #include "platform/heap/Visitor.h"
 #include "wtf/AddressSanitizer.h"
 #include "wtf/Allocator.h"
 #include "wtf/Assertions.h"
 #include "wtf/Atomics.h"
 #include "wtf/Forward.h"
 #include <memory>
 
 namespace blink {
@@ skipping 419 matching lines @@
     }
 
     void operator delete(void* p)
     {
         ASSERT_NOT_REACHED();
     }
 
 protected:
     GarbageCollected()
     {
+        // A GarbageCollected<> object should not be stack allocated
+        // as it won't be prefixed with a (heap) header which would
+        // fail if the stack object ends up being stored in a traceable
+        // member field (say.)
+        DCHECK(!StackFrameDepth::isStackAddress(this));
     }
 };
 
 // Assigning class types to their arenas.
 //
 // We use sized arenas for most 'normal' objects to improve memory locality.
 // It seems that the same type of objects are likely to be accessed together,
 // which means that we want to group objects by type. That's one reason
 // why we provide dedicated arenas for popular types (e.g., Node, CSSValue),
 // but it's not practical to prepare dedicated arenas for all types.
@@ skipping 132 matching lines @@
 void VisitorHelper<Derived>::handleWeakCell(Visitor* self, void* object)
 {
     T** cell = reinterpret_cast<T**>(object);
     if (*cell && !ObjectAliveTrait<T>::isHeapObjectAlive(*cell))
         *cell = nullptr;
 }
 
 } // namespace blink
 
 #endif // Heap_h