Fix PartitionAlloc cookies for large in-place reallocs

base/allocator/partition_allocator/partition_alloc_unittest.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/allocator/partition_allocator/partition_alloc.h"
 
 #include <stdlib.h>
 #include <string.h>
 
 #include <memory>
@@ skipping 2070 matching lines @@
     CheckPageInCore(ptr1 - kPointerOffset + (kSystemPageSize * 2), false);
     CheckPageInCore(ptr1 - kPointerOffset + (kSystemPageSize * 3), false);
 
     EXPECT_FALSE(page->freelist_head);
 
     PartitionFreeGeneric(generic_allocator.root(), ptr1);
     PartitionFreeGeneric(generic_allocator.root(), ptr2);
   }
 }
 
+TEST(PartitionAllocTest, ReallocMovesCookies) {
+  TestSetup();
+
+  // Resize so as to be sure to hit a "resize in place" case, and ensure that
+  // use of the entire result is compatible with the debug mode's cookies, even
+  // when the bucket size is large enough to span more than one partition page
+  // and we can track the "raw" size. See https://crbug.com/709271
+  const size_t kSize = base::kMaxSystemPagesPerSlotSpan * base::kSystemPageSize;
+  void* ptr =
+      PartitionAllocGeneric(generic_allocator.root(), kSize + 1, type_name);
+  EXPECT_TRUE(ptr);
+
+  memset(ptr, 0xbd, kSize + 1);
+  ptr = PartitionReallocGeneric(generic_allocator.root(), ptr, kSize + 2,
+                                type_name);
+  EXPECT_TRUE(ptr);
+
+  memset(ptr, 0xbd, kSize + 2);
+  PartitionFreeGeneric(generic_allocator.root(), ptr);
+}
+
 }  // namespace base
 
 #endif  // !defined(MEMORY_TOOL_REPLACES_ALLOCATOR)