Temporarily CHECK use after free in Value

base/values.cc

Index: base/values.cc
diff --git a/base/values.cc b/base/values.cc
index 5cc0d693bdd11c12e60f14f8921bec3cd303e4da..9aef2ec67005a7608405beaf2bafcdb496bc06f7 100644
--- a/base/values.cc
+++ b/base/values.cc
@@ -124,6 +124,10 @@ Value::Value(Type type) : type_(type) {
     case Type::LIST:
       list_.Init();
       return;
+    case Type::DELETED:
+      // TODO(crbug.com/697817): Remove.
+      CHECK(false);
+      return;
   }
 }
 
@@ -200,6 +204,7 @@ Value& Value::operator=(Value&& that) {
 
 Value::~Value() {
   InternalCleanup();
+  type_ = Type::DELETED;
 }
 
 // static
@@ -442,6 +447,10 @@ bool Value::Equals(const Value* other) const {
                           return lhs->Equals(rhs.get());
                         });
     }
+    case Type::DELETED:
+      // TODO(crbug.com/697817): This means a use-after-free.
+      CHECK(false);
+      return false;
   }
 
   NOTREACHED();
@@ -503,6 +512,10 @@ void Value::InternalCopyConstructFrom(const Value& that) {
     case Type::LIST:
       list_.Init(std::move(*that.CreateDeepCopy()->list_));
       return;
+    case Type::DELETED:
+      // TODO(crbug.com/697817): This means |that| is used after free.
+      CHECK(false);
+      return;
   }
 }
 
@@ -529,6 +542,10 @@ void Value::InternalMoveConstructFrom(Value&& that) {
     case Type::LIST:
       list_.InitFromMove(std::move(that.list_));
       return;
+    case Type::DELETED:
+      // TODO(crbug.com/697817): This means |that| is used after free.
+      CHECK(false);
+      return;
   }
 }
 
@@ -559,6 +576,10 @@ void Value::InternalCopyAssignFromSameType(const Value& that) {
     case Type::LIST:
       *list_ = std::move(*that.CreateDeepCopy()->list_);
       return;
+    case Type::DELETED:
+      // TODO(crbug.com/697817): This means |that| is used after free.
+      CHECK(false);
+      return;
   }
 }
 
@@ -585,6 +606,10 @@ void Value::InternalMoveAssignFromSameType(Value&& that) {
     case Type::LIST:
       *list_ = std::move(*that.list_);
       return;
+    case Type::DELETED:
+      // TODO(crbug.com/697817): This means |that| is used after free.
+      CHECK(false);
+      return;
   }
 }
 
@@ -609,6 +634,10 @@ void Value::InternalCleanup() {
     case Type::LIST:
       list_.Destroy();
       return;
+    case Type::DELETED:
+      // TODO(crbug.com/697817): This means a use-after-free.
+      CHECK(false);
+      return;
   }
 }