Check if Persistent owner thread matches pointer thread and current thread

third_party/WebKit/Source/platform/heap/Persistent.h

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef Persistent_h
 #define Persistent_h
 
 #include "platform/heap/Heap.h"
 #include "platform/heap/Member.h"
 #include "platform/heap/PersistentNode.h"
@@ skipping 21 matching lines @@
     CrossThreadPersistentConfiguration
 };
 
 template<typename T, WeaknessPersistentConfiguration weaknessConfiguration, CrossThreadnessPersistentConfiguration crossThreadnessConfiguration>
 class PersistentBase {
     USING_FAST_MALLOC(PersistentBase);
     IS_PERSISTENT_REFERENCE_TYPE();
 public:
     PersistentBase() : m_raw(nullptr)
     {
+        saveCreationThreadHeap();
         initialize();
     }
 
     PersistentBase(std::nullptr_t) : m_raw(nullptr)
     {
+        saveCreationThreadHeap();
         initialize();
     }
 
     PersistentBase(T* raw) : m_raw(raw)
     {
+        saveCreationThreadHeap();
         initialize();
         checkPointer();
     }
 
     PersistentBase(T& raw) : m_raw(&raw)
     {
+        saveCreationThreadHeap();
         initialize();
         checkPointer();
     }
 
     PersistentBase(const PersistentBase& other) : m_raw(other)
     {
+        saveCreationThreadHeap();
         initialize();
         checkPointer();
     }
 
     template<typename U>
     PersistentBase(const PersistentBase<U, weaknessConfiguration, crossThreadnessConfiguration>& other) : m_raw(other)
     {
+        saveCreationThreadHeap();
         initialize();
         checkPointer();
     }
 
     template<typename U>
     PersistentBase(const Member<U>& other) : m_raw(other)
     {
+        saveCreationThreadHeap();
         initialize();
         checkPointer();
     }
 
     PersistentBase(WTF::HashTableDeletedValueType) : m_raw(reinterpret_cast<T*>(-1))
     {
+        saveCreationThreadHeap();
         initialize();
         checkPointer();
     }
 
     ~PersistentBase()
     {
         uninitialize();
         m_raw = nullptr;
     }
 
@@ skipping 133 matching lines @@
         ThreadState* state = ThreadStateFor<ThreadingTrait<T>::Affinity>::state();
         ASSERT(state->checkThread());
         // Persistent handle must be created and destructed in the same thread.
         ASSERT(m_state == state);
         state->freePersistentNode(m_persistentNode);
         m_persistentNode = nullptr;
     }
 
     void checkPointer()
     {
-#if ENABLE(ASSERT) && defined(ADDRESS_SANITIZER)
+#if DCHECK_IS_ON()
         if (!m_raw || isHashTableDeletedValue())
             return;
 
+        if (crossThreadnessConfiguration != CrossThreadPersistentConfiguration) {
+            ThreadState* current = ThreadState::current();
+            DCHECK(current);
+            // m_creationThreadState may be null when this is used in a heap
+            // collection which initialized the Member with memset and the
+            // constructor wasn't called.
+            if (m_creationThreadState) {
+                // Member should point to objects that belong in the same ThreadHeap.
+                DCHECK_EQ(&ThreadState::fromObject(m_raw)->heap(), &m_creationThreadState->heap());
+                // Member should point to objects that belong in the same ThreadHeap.
+                DCHECK_EQ(&current->heap(), &m_creationThreadState->heap());
+            }
+        }
+
+#if defined(ADDRESS_SANITIZER)
         // ThreadHeap::isHeapObjectAlive(m_raw) checks that m_raw is a traceable
         // object. In other words, it checks that the pointer is either of:
         //
         //   (a) a pointer to the head of an on-heap object.
         //   (b) a pointer to the head of an on-heap mixin object.
         //
         // Otherwise, ThreadHeap::isHeapObjectAlive will crash when it calls
         // header->checkHeader().
         ThreadHeap::isHeapObjectAlive(m_raw);
 #endif
+#endif
+    }
+
+    void saveCreationThreadHeap()
+    {
+#if DCHECK_IS_ON()
+        if (crossThreadnessConfiguration == CrossThreadPersistentConfiguration) {
+            m_creationThreadState = nullptr;
+        } else {
+            m_creationThreadState = ThreadState::current();
+            // Members should be created in an attached thread. But an empty
+            // value Member may be created on an unattached thread by a heap
+            // collection iterator.
+            DCHECK(m_creationThreadState);
+        }
+#endif
     }
 
     static void handleWeakPersistent(Visitor* self, void* persistentPointer)
     {
         using Base = PersistentBase<typename std::remove_const<T>::type, weaknessConfiguration, crossThreadnessConfiguration>;
         Base* persistent = reinterpret_cast<Base*>(persistentPointer);
         T* object = persistent->get();
         if (object && !ObjectAliveTrait<T>::isHeapObjectAlive(object))
             persistent->clear();
     }
 
     // m_raw is accessed most, so put it at the first field.
     T* m_raw;
     PersistentNode* m_persistentNode = nullptr;
 #if ENABLE(ASSERT)
     ThreadState* m_state = nullptr;
 #endif
+#if DCHECK_IS_ON()
+    const ThreadState* m_creationThreadState;
+#endif
 };
 
 // Persistent is a way to create a strong pointer from an off-heap object
 // to another on-heap object. As long as the Persistent handle is alive
 // the GC will keep the object pointed to alive. The Persistent handle is
 // always a GC root from the point of view of the GC.
 //
 // We have to construct and destruct Persistent in the same thread.
 template<typename T>
 class Persistent : public PersistentBase<T, NonWeakPersistentConfiguration, SingleThreadPersistentConfiguration> {
@@ skipping 445 matching lines @@
 
 template <typename T>
 struct IsWeakReceiver<blink::WeakPersistent<T>> : std::true_type {};
 
 template <typename T>
 struct IsWeakReceiver<blink::CrossThreadWeakPersistent<T>> : std::true_type {};
 
 }
 
 #endif // Persistent_h