Verify that a new heap page isn't also marked as being off heap.

third_party/WebKit/Source/platform/heap/ThreadState.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 1066 matching lines @@
 }
 
 #if DCHECK_IS_ON()
 BasePage* ThreadState::findPageFromAddress(Address address) {
   for (int i = 0; i < BlinkGC::NumberOfArenas; ++i) {
     if (BasePage* page = m_arenas[i]->findPageFromAddress(address))
       return page;
   }
   return nullptr;
 }
+
+bool ThreadState::isAddressInHeapDoesNotContainCache(Address address) {
+  // If the cache has been marked as invalidated, it's cleared prior
+  // to performing the next GC. Hence, consider the cache as being
+  // effectively empty.
+  if (m_shouldFlushHeapDoesNotContainCache)
+    return false;
+  return heap().m_heapDoesNotContainCache->lookup(address);
+}
 #endif
 
 size_t ThreadState::objectPayloadSizeForTesting() {
   size_t objectPayloadSize = 0;
   for (int i = 0; i < BlinkGC::NumberOfArenas; ++i)
     objectPayloadSize += m_arenas[i]->objectPayloadSizeForTesting();
   return objectPayloadSize;
 }
 
 void ThreadState::safePoint(BlinkGC::StackState stackState) {
@@ skipping 452 matching lines @@
     collectGarbage(BlinkGC::NoHeapPointersOnStack, BlinkGC::GCWithSweep,
                    BlinkGC::ForcedGC);
     size_t liveObjects = heap().heapStats().markedObjectSize();
     if (liveObjects == previousLiveObjects)
       break;
     previousLiveObjects = liveObjects;
   }
 }
 
 }  // namespace blink