Disable collection backing reallocation during pre finalizer

third_party/WebKit/Source/platform/wtf/Vector.h

 /*
  *  Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
  *  License as published by the Free Software Foundation; either
  *  version 2 of the License, or (at your option) any later version.
  *
  *  This library is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 1576 matching lines @@
 #ifdef ANNOTATE_CONTIGUOUS_CONTAINER
   size_t old_capacity = Capacity();
 #endif
   // The Allocator::isGarbageCollected check is not needed.  The check is just
   // a static hint for a compiler to indicate that Base::expandBuffer returns
   // false if Allocator is a PartitionAllocator.
   if (Allocator::kIsGarbageCollected && Base::ExpandBuffer(new_capacity)) {
     ANNOTATE_CHANGE_CAPACITY(begin(), old_capacity, size_, Capacity());
     return;
   }
+  // Reallocating a backing buffer may resurrect a dead object.
+  CHECK(!Allocator::IsObjectResurrectionForbidden());
+
   T* old_end = end();
   Base::AllocateExpandedBuffer(new_capacity);
   ANNOTATE_NEW_BUFFER(begin(), Capacity(), size_);
   TypeOperations::Move(old_buffer, old_end, begin());
   ClearUnusedSlots(old_buffer, old_end);
   ANNOTATE_DELETE_BUFFER(old_buffer, old_capacity, size_);
   Base::DeallocateBuffer(old_buffer);
 }
 
 template <typename T, size_t inlineCapacity, typename Allocator>
 inline void Vector<T, inlineCapacity, Allocator>::ReserveInitialCapacity(
     size_t initial_capacity) {
   DCHECK(!size_);
   DCHECK(Capacity() == INLINE_CAPACITY);
   if (initial_capacity > INLINE_CAPACITY) {
     ANNOTATE_DELETE_BUFFER(begin(), Capacity(), size_);
     Base::AllocateBuffer(initial_capacity);
     ANNOTATE_NEW_BUFFER(begin(), Capacity(), size_);
   }
 }
 
 template <typename T, size_t inlineCapacity, typename Allocator>
 void Vector<T, inlineCapacity, Allocator>::ShrinkCapacity(size_t new_capacity) {
   if (new_capacity >= Capacity())
     return;
 
   if (new_capacity < size())
     Shrink(new_capacity);
 
+  if (Allocator::IsObjectResurrectionForbidden())

[sof, 2017/04/15 18:57:31]

Why leave early for the new_capacity == 0 case?

[keishi, 2017/04/17 06:37:55]

Created fix at https://codereview.chromium.org/2816373003/

+    return;
+
   T* old_buffer = begin();
 #ifdef ANNOTATE_CONTIGUOUS_CONTAINER
   size_t old_capacity = Capacity();
 #endif
   if (new_capacity > 0) {
     if (Base::ShrinkBuffer(new_capacity)) {
       ANNOTATE_CHANGE_CAPACITY(begin(), old_capacity, size_, Capacity());
       return;
     }
 
@@ skipping 271 matching lines @@
           visitor, *const_cast<T*>(buffer_entry));
     CheckUnusedSlots(Buffer() + size(), Buffer() + Capacity());
   }
 }
 
 }  // namespace WTF
 
 using WTF::Vector;
 
 #endif  // WTF_Vector_h