Check if Persistent owner thread matches pointer thread and current thread

third_party/WebKit/Source/platform/heap/Persistent.h

Index: third_party/WebKit/Source/platform/heap/Persistent.h
diff --git a/third_party/WebKit/Source/platform/heap/Persistent.h b/third_party/WebKit/Source/platform/heap/Persistent.h
index 420d487cb2c0af301e3f82d17f3616d228fb6d22..7a5ddc04e98b851232b8b84d35f8676507762688 100644
--- a/third_party/WebKit/Source/platform/heap/Persistent.h
+++ b/third_party/WebKit/Source/platform/heap/Persistent.h
@@ -39,28 +39,33 @@ class PersistentBase {
 public:
     PersistentBase() : m_raw(nullptr)
     {
+        saveCreationThreadHeap();
         initialize();
     }
 
     PersistentBase(std::nullptr_t) : m_raw(nullptr)
     {
+        saveCreationThreadHeap();
         initialize();
     }
 
     PersistentBase(T* raw) : m_raw(raw)
     {
+        saveCreationThreadHeap();
         initialize();
         checkPointer();
     }
 
     PersistentBase(T& raw) : m_raw(&raw)
     {
+        saveCreationThreadHeap();
         initialize();
         checkPointer();
     }
 
     PersistentBase(const PersistentBase& other) : m_raw(other)
     {
+        saveCreationThreadHeap();
         initialize();
         checkPointer();
     }
@@ -68,6 +73,7 @@ public:
     template<typename U>
     PersistentBase(const PersistentBase<U, weaknessConfiguration, crossThreadnessConfiguration>& other) : m_raw(other)
     {
+        saveCreationThreadHeap();
         initialize();
         checkPointer();
     }
@@ -75,12 +81,14 @@ public:
     template<typename U>
     PersistentBase(const Member<U>& other) : m_raw(other)
     {
+        saveCreationThreadHeap();
         initialize();
         checkPointer();
     }
 
     PersistentBase(WTF::HashTableDeletedValueType) : m_raw(reinterpret_cast<T*>(-1))
     {
+        saveCreationThreadHeap();
         initialize();
         checkPointer();
     }
@@ -234,10 +242,25 @@ private:
 
     void checkPointer()
     {
-#if ENABLE(ASSERT) && defined(ADDRESS_SANITIZER)
+#if DCHECK_IS_ON()
         if (!m_raw || isHashTableDeletedValue())
             return;
 
+        if (crossThreadnessConfiguration != CrossThreadPersistentConfiguration) {
+            ThreadState* current = ThreadState::current();
+            DCHECK(current);
+            // m_creationThreadState may be null when this is used in a heap
+            // collection which initialized the Member with memset and the
+            // constructor wasn't called.
+            if (m_creationThreadState) {
+                // Member should point to objects that belong in the same ThreadHeap.
+                DCHECK_EQ(&ThreadState::fromObject(m_raw)->heap(), &m_creationThreadState->heap());
+                // Member should point to objects that belong in the same ThreadHeap.
+                DCHECK_EQ(&current->heap(), &m_creationThreadState->heap());
+            }
+        }
+
+#if defined(ADDRESS_SANITIZER)
         // ThreadHeap::isHeapObjectAlive(m_raw) checks that m_raw is a traceable
         // object. In other words, it checks that the pointer is either of:
         //
@@ -248,6 +271,22 @@ private:
         // header->checkHeader().
         ThreadHeap::isHeapObjectAlive(m_raw);
 #endif
+#endif
+    }
+
+    void saveCreationThreadHeap()
+    {
+#if DCHECK_IS_ON()
+        if (crossThreadnessConfiguration == CrossThreadPersistentConfiguration) {
+            m_creationThreadState = nullptr;
+        } else {
+            m_creationThreadState = ThreadState::current();
+            // Members should be created in an attached thread. But an empty
+            // value Member may be created on an unattached thread by a heap
+            // collection iterator.
+            DCHECK(m_creationThreadState);
+        }
+#endif
     }
 
     static void handleWeakPersistent(Visitor* self, void* persistentPointer)
@@ -265,6 +304,9 @@ private:
 #if ENABLE(ASSERT)
     ThreadState* m_state = nullptr;
 #endif
+#if DCHECK_IS_ON()
+    const ThreadState* m_creationThreadState;
+#endif
 };
 
 // Persistent is a way to create a strong pointer from an off-heap object