Chromium 284577 needs a mitigation CL added. There is a TODO to remove

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index d586c4abf7e292da963c6f2aba3f031ce1b9b700..1fbfbd3b31eae3a9edb95111d07a2d4d7771b54f 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -9016,8 +9016,7 @@ AllocationMemento* AllocationMemento::FindForJSObject(JSObject* object) {
   // involves carefully checking the object immediately after the JSArray
   // (if there is one) to see if it's an AllocationMemento.
   if (FLAG_track_allocation_sites && object->GetHeap()->InNewSpace(object)) {
-    // TODO(mvstanton): CHECK to diagnose chromium bug 284577, remove after.
-    CHECK(object->GetHeap()->InToSpace(object));
+    ASSERT(object->GetHeap()->InToSpace(object));
     Address ptr_end = (reinterpret_cast<Address>(object) - kHeapObjectTag) +
         object->Size();
     if ((ptr_end + AllocationMemento::kSize) <=
@@ -9027,15 +9026,20 @@ AllocationMemento* AllocationMemento::FindForJSObject(JSObject* object) {
           reinterpret_cast<Map**>(ptr_end);
       if (*possible_allocation_memento_map ==
           object->GetHeap()->allocation_memento_map()) {
-        Address ptr_object = reinterpret_cast<Address>(object);
-        // TODO(mvstanton): CHECK to diagnose chromium bug 284577, remove after.
-        // If this check fails it points to the very unlikely case that we've
-        // misinterpreted a page header as an allocation memento. Follow up
-        // with a real fix.
-        CHECK(Page::FromAddress(ptr_object) == Page::FromAddress(ptr_end));
         AllocationMemento* memento = AllocationMemento::cast(
             reinterpret_cast<Object*>(ptr_end + kHeapObjectTag));
-        return memento;
+
+        // TODO(mvstanton): because of chromium bug 284577, put extra care
+        // into validating that the memento points to a valid AllocationSite.
+        // This check is expensive so remove it asap. Also, this check
+        // HIDES bug 284577, so it must be disabled to debug/diagnose.
+        Object* site = memento->allocation_site();
+        Address site_address = (reinterpret_cast<Address>(site) -

[Michael Starzinger, 2013/09/16 16:12:56]

nit: As discussed offline with Hannes, better use
Heap::InOldPointerSpace(Object*) here.

[mvstanton, 2013/09/16 16:38:28]

Done.

+                                kHeapObjectTag);
+        if (IsAddressAligned(site_address, kPointerSize) &&
+            object->GetHeap()->Contains(site_address)) {

[Hannes Payer (out of office), 2013/09/16 16:12:05]

Instead of checking the whole heap, you could check if the address is in old
pointer space since this is the place where allocation sites should be
allocated.

[mvstanton, 2013/09/16 16:38:28]

Done.

+          return memento;
+        }
       }
     }
   }