Check that heap collection backing reallocation happens on the same heap

third_party/WebKit/Source/platform/heap/HeapAllocator.cpp

Index: third_party/WebKit/Source/platform/heap/HeapAllocator.cpp
diff --git a/third_party/WebKit/Source/platform/heap/HeapAllocator.cpp b/third_party/WebKit/Source/platform/heap/HeapAllocator.cpp
index 73d6ab6daa2edf334fe879b0e014e2bb957047f0..5cd5a3e183658af5a04406600342af6c297ba573 100644
--- a/third_party/WebKit/Source/platform/heap/HeapAllocator.cpp
+++ b/third_party/WebKit/Source/platform/heap/HeapAllocator.cpp
@@ -54,6 +54,7 @@ bool HeapAllocator::backingExpand(void* address, size_t newSize)
         return false;
     ASSERT(!state->isInGC());
     ASSERT(state->isAllocationAllowed());
+    DCHECK_EQ(&state->heap(), &ThreadState::fromObject(address)->heap());
 
     // FIXME: Support expand for large objects.
     // Don't expand backings allocated on other threads.
@@ -97,6 +98,7 @@ bool HeapAllocator::backingShrink(void* address, size_t quantizedCurrentSize, si
         return false;
     ASSERT(!state->isInGC());
     ASSERT(state->isAllocationAllowed());
+    DCHECK_EQ(&state->heap(), &ThreadState::fromObject(address)->heap());
 
     // FIXME: Support shrink for large objects.
     // Don't shrink backings allocated on other threads.