| Index: third_party/WebKit/Source/platform/heap/HeapPage.cpp
 | 
| diff --git a/third_party/WebKit/Source/platform/heap/HeapPage.cpp b/third_party/WebKit/Source/platform/heap/HeapPage.cpp
 | 
| index 5060a23f9a4d482e82a219a950fea783cce7b49e..2d69b0ec6512c92ed0ffbb70fd8272a59e6d091f 100644
 | 
| --- a/third_party/WebKit/Source/platform/heap/HeapPage.cpp
 | 
| +++ b/third_party/WebKit/Source/platform/heap/HeapPage.cpp
 | 
| @@ -706,7 +706,6 @@ bool NormalPageArena::coalesce() {
 | 
|          headerAddress += size;
 | 
|          continue;
 | 
|        }
 | 
| -      header->checkHeader();
 | 
|        if (startOfGap != headerAddress)
 | 
|          addToFreeList(startOfGap, headerAddress - startOfGap);
 | 
|  
 | 
| @@ -725,7 +724,6 @@ bool NormalPageArena::coalesce() {
 | 
|  
 | 
|  void NormalPageArena::promptlyFreeObject(HeapObjectHeader* header) {
 | 
|    ASSERT(!getThreadState()->sweepForbidden());
 | 
| -  header->checkHeader();
 | 
|    Address address = reinterpret_cast<Address>(header);
 | 
|    Address payload = header->payload();
 | 
|    size_t size = header->size();
 | 
| @@ -753,7 +751,6 @@ bool NormalPageArena::expandObject(HeapObjectHeader* header, size_t newSize) {
 | 
|    // It's possible that Vector requests a smaller expanded size because
 | 
|    // Vector::shrinkCapacity can set a capacity smaller than the actual payload
 | 
|    // size.
 | 
| -  header->checkHeader();
 | 
|    if (header->payloadSize() >= newSize)
 | 
|      return true;
 | 
|    size_t allocationSize = ThreadHeap::allocationSizeFromSize(newSize);
 | 
| @@ -774,7 +771,6 @@ bool NormalPageArena::expandObject(HeapObjectHeader* header, size_t newSize) {
 | 
|  }
 | 
|  
 | 
|  bool NormalPageArena::shrinkObject(HeapObjectHeader* header, size_t newSize) {
 | 
| -  header->checkHeader();
 | 
|    ASSERT(header->payloadSize() > newSize);
 | 
|    size_t allocationSize = ThreadHeap::allocationSizeFromSize(newSize);
 | 
|    ASSERT(header->size() > allocationSize);
 | 
| @@ -1003,7 +999,6 @@ Address LargeObjectArena::doAllocateLargeObjectPage(size_t allocationSize,
 | 
|    ASSERT(!(reinterpret_cast<uintptr_t>(result) & allocationMask));
 | 
|    LargeObjectPage* largeObject = new (largeObjectAddress)
 | 
|        LargeObjectPage(pageMemory, this, allocationSize);
 | 
| -  header->checkHeader();
 | 
|  
 | 
|    // Poison the object header and allocationGranularity bytes after the object
 | 
|    ASAN_POISON_MEMORY_REGION(header, sizeof(*header));
 | 
| @@ -1261,7 +1256,6 @@ size_t NormalPage::objectPayloadSizeForTesting() {
 | 
|      HeapObjectHeader* header =
 | 
|          reinterpret_cast<HeapObjectHeader*>(headerAddress);
 | 
|      if (!header->isFree()) {
 | 
| -      header->checkHeader();
 | 
|        objectPayloadSize += header->payloadSize();
 | 
|      }
 | 
|      ASSERT(header->size() < blinkPagePayloadSize());
 | 
| @@ -1577,7 +1571,6 @@ HeapObjectHeader* NormalPage::findHeaderFromAddress(Address address) {
 | 
|    HeapObjectHeader* header = reinterpret_cast<HeapObjectHeader*>(objectAddress);
 | 
|    if (header->isFree())
 | 
|      return nullptr;
 | 
| -  header->checkHeader();
 | 
|    return header;
 | 
|  }
 | 
|  
 | 
| @@ -1594,7 +1587,6 @@ static bool isUninitializedMemory(void* objectPointer, size_t objectSize) {
 | 
|  #endif
 | 
|  
 | 
|  static void markPointer(Visitor* visitor, HeapObjectHeader* header) {
 | 
| -  header->checkHeader();
 | 
|    const GCInfo* gcInfo = ThreadHeap::gcInfo(header->gcInfoIndex());
 | 
|    if (gcInfo->hasVTable() && !vTableInitialized(header->payload())) {
 | 
|      // We hit this branch when a GC strikes before GarbageCollected<>'s
 | 
| 
 |