Oilpan: isHeapObjectAlive should not return true for cross thread objects

third_party/WebKit/Source/platform/heap/Heap.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 230 matching lines @@
     // collection has been strongified, there is no way that it can contain
     // non-live entries, so no entries will be removed. Since you can't set
     // the mark bit on a null pointer, that means that null pointers are
     // always 'alive'.
     if (!object)
       return true;
     // TODO(keishi): some tests create CrossThreadPersistent on non attached
     // threads.
     if (!ThreadState::current())
       return true;
-    if (&ThreadState::current()->heap() !=
-        &pageFromObject(object)->arena()->getThreadState()->heap())
-      return true;
+    DCHECK(&ThreadState::current()->heap() ==

[sof, 2017/03/28 19:50:09]

How does this work for CrossThreadWeakPersistent<> and handleWeakPersistent()'s
use of isHeapObjectAlive() ?

[sof, 2017/03/28 20:02:07]

The shouldTracePersistentNode() same-heap check should prevent cross-thread uses
of such persistents, so there can't be any confusion about where that weak
callback is used.

+           &pageFromObject(object)->arena()->getThreadState()->heap());
     return ObjectAliveTrait<T>::isHeapObjectAlive(object);
   }
   template <typename T>
   static inline bool isHeapObjectAlive(const Member<T>& member) {
     return isHeapObjectAlive(member.get());
   }
   template <typename T>
   static inline bool isHeapObjectAlive(const WeakMember<T>& member) {
     return isHeapObjectAlive(member.get());
   }
@@ skipping 397 matching lines @@
   T** cell = reinterpret_cast<T**>(object);
   if (*cell && !ObjectAliveTrait<T>::isHeapObjectAlive(*cell))
     *cell = nullptr;
 }
 
 }  // namespace blink
 
 #include "platform/heap/VisitorImpl.h"
 
 #endif  // Heap_h