Check that heap collection backing reallocation happens on the same heap

third_party/WebKit/Source/platform/heap/HeapAllocator.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "platform/heap/HeapAllocator.h"
 
 namespace blink {
 
 void HeapAllocator::backingFree(void* address)
 {
@@ skipping 36 matching lines @@
 bool HeapAllocator::backingExpand(void* address, size_t newSize)
 {
     if (!address)
         return false;
 
     ThreadState* state = ThreadState::current();
     if (state->sweepForbidden())
         return false;
     ASSERT(!state->isInGC());
     ASSERT(state->isAllocationAllowed());
+    DCHECK_EQ(&state->heap(), &ThreadState::fromObject(address)->heap());
 
     // FIXME: Support expand for large objects.
     // Don't expand backings allocated on other threads.
     BasePage* page = pageFromObject(address);
     if (page->isLargeObjectPage() || page->arena()->getThreadState() != state)
         return false;
 
     HeapObjectHeader* header = HeapObjectHeader::fromPayload(address);
     ASSERT(header->checkHeader());
     NormalPageArena* arena = static_cast<NormalPage*>(page)->arenaForNormalPage();
@@ skipping 23 matching lines @@
     if (!address || quantizedShrunkSize == quantizedCurrentSize)
         return true;
 
     ASSERT(quantizedShrunkSize < quantizedCurrentSize);
 
     ThreadState* state = ThreadState::current();
     if (state->sweepForbidden())
         return false;
     ASSERT(!state->isInGC());
     ASSERT(state->isAllocationAllowed());
+    DCHECK_EQ(&state->heap(), &ThreadState::fromObject(address)->heap());
 
     // FIXME: Support shrink for large objects.
     // Don't shrink backings allocated on other threads.
     BasePage* page = pageFromObject(address);
     if (page->isLargeObjectPage() || page->arena()->getThreadState() != state)
         return false;
 
     HeapObjectHeader* header = HeapObjectHeader::fromPayload(address);
     ASSERT(header->checkHeader());
     NormalPageArena* arena = static_cast<NormalPage*>(page)->arenaForNormalPage();
@@ skipping 13 matching lines @@
 {
     return backingShrink(address, quantizedCurrentSize, quantizedShrunkSize);
 }
 
 bool HeapAllocator::shrinkInlineVectorBacking(void* address, size_t quantizedCurrentSize, size_t quantizedShrunkSize)
 {
     return backingShrink(address, quantizedCurrentSize, quantizedShrunkSize);
 }
 
 } // namespace blink