Verify that a new heap page isn't also marked as being off heap.

third_party/WebKit/Source/platform/heap/PageMemory.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef PageMemory_h
 #define PageMemory_h
 
 #include "platform/heap/HeapPage.h"
 #include "wtf/Allocator.h"
 #include "wtf/Assertions.h"
@@ skipping 156 matching lines @@
   USING_FAST_MALLOC(PageMemory);
 
  public:
   ~PageMemory() {
     __lsan_unregister_root_region(m_writable.base(), m_writable.size());
     m_reserved->pageDeleted(writableStart());
   }
 
   WARN_UNUSED_RESULT bool commit() {
     m_reserved->markPageUsed(writableStart());
+    // Check that in-use page isn't also marked as being a non-heap page
+    // by the current heap's negative cache. That cache is invalidated
+    // when allocating new pages, but crbug.com/649485 suggests that
+    // we do get out of sync somehow.
+    //
+    // TODO(sof): consider removing check once bug has been diagnosed
+    // and addressed.
+    CHECK(!ThreadState::current()->isAddressInHeapDoesNotContainCache(
+        writableStart()));
     return m_writable.commit();
   }
 
   void decommit() {
     m_reserved->markPageUnused(writableStart());
     m_writable.decommit();
   }
 
   void markUnused() { m_reserved->markPageUnused(writableStart()); }
 
@@ skipping 18 matching lines @@
  private:
   PageMemory(PageMemoryRegion* reserved, const MemoryRegion& writable);
 
   PageMemoryRegion* m_reserved;
   MemoryRegion m_writable;
 };
 
 }  // namespace blink
 
 #endif