1. Enable large object pointer offset check in release build.

base/allocator/tcmalloc_free_check_test.cc

Index: base/allocator/tcmalloc_free_check_test.cc
===================================================================
--- base/allocator/tcmalloc_free_check_test.cc	(revision 0)
+++ base/allocator/tcmalloc_free_check_test.cc	(working copy)
@@ -0,0 +1,49 @@
+// Copyright 2012 Google Inc. All Rights Reserved.
+// Author: kaiwang@google.com (Kai Wang)
+
+#include <stdio.h>
+#include "base/allocator/allocator_shim.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+// TCMalloc header files
+#include "common.h"  // For TCMalloc constants like page size, etc.
+
+using base::allocator::TCMallocDoMallocForTest;
+using base::allocator::TCMallocDoFreeForTest;
+
+TEST(TCMallocFreeCheck, BadPointerInFirstPageOfTheLargeObject) {
+  volatile int* p = 
+      reinterpret_cast<volatile int*>(TCMallocDoMallocForTest(kMaxSize + 1));

[jar (doing other things), 2012/05/17 01:36:41]

nit: No need for volatile here.

[kaiwang, 2012/05/19 00:12:27]

Done.

+  ASSERT_DEATH(TCMallocDoFreeForTest(const_cast<int*>(p + kAlignment)),

[jar (doing other things), 2012/05/17 01:36:41]

Perhaps try adding small powers of two: 1, 2, 4, 8, ... 1024

[kaiwang, 2012/05/19 00:12:27]

Done.

+               "Pointer not pointed to the start of a span");
+}
+
+TEST(TCMallocFreeCheck, BadPointerInSubsequentPagesOfTheLargeObject) {

[jar (doing other things), 2012/05/17 01:36:41]

nit: suggest better name:
BadPageAlignedPointerInsideLargeObject

[kaiwang, 2012/05/19 00:12:27]

Done.

+  volatile int* p = 
+      reinterpret_cast<volatile int*>(TCMallocDoMallocForTest(kMaxSize + 1));
+  ASSERT_DEATH(TCMallocDoFreeForTest(const_cast<int*>(p + kPageSize)),

[jar (doing other things), 2012/05/17 01:36:41]

perhaps iterate at page boundaries (but stay inside object)

+               "Attempt to free invalid pointer");
+}
+/*
+#ifndef NDEBUG
+TEST(TCMallocFreeCheck, DoubleFreeLargeObject) {
+  volatile int* p = 
+      reinterpret_cast<volatile int*>(TCMallocDoMallocForTest(kMaxSize + 1));
+  TCMallocDoFreeForTest(const_cast<int*>(p));
+  ASSERT_DEATH(TCMallocDoFreeForTest(const_cast<int*>(p)),
+               "Attempt to double free");
+}
+
+TEST(TCMallocFreeCheck, DoubleFreeSmallObject) {
+  volatile int* p = 
+      reinterpret_cast<volatile int*>(TCMallocDoMallocForTest(kMaxSize));
+  TCMallocDoFreeForTest(const_cast<int*>(p));
+  ASSERT_DEATH(TCMallocDoFreeForTest(const_cast<int*>(p)),
+               "Attempt to double free");
+}
+#endif
+*/
+int main(int argc, char **argv) {
+  testing::InitGoogleTest(&argc, argv);
+  return RUN_ALL_TESTS();
+}