Ensure we mask freelist pointers properly on 32-bit Linux

third_party/tcmalloc/chromium/src/free_list.cc

 // Copyright (c) 2011, Google Inc.
 // All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 // notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
@@ skipping 64 matching lines @@
 namespace {
 void EnsureNonLoop(void* node, void* next) {
   // We only have time to do minimal checking.  We don't traverse the list, but
   // only look for an immediate loop (cycle back to ourself).
   if (node != next) return;
   Log(kCrash, __FILE__, __LINE__, "Circular loop in list detected: ", next);
 }
 
 inline void* MaskPtr(void* p) {
   // Maximize ASLR entropy and guarantee the result is an invalid address.
-  const uintptr_t q = ~(reinterpret_cast<intptr_t>(TCMalloc_SystemAlloc) >> 13);
+  const uintptr_t mask = ~(reinterpret_cast<uintptr_t>(TCMalloc_SystemAlloc)
+                           >> 13) | 1;
   // Do not mask NULL pointers, otherwise we could leak address state.
   if (p)
-    return reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(p) ^ q);
+    return reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(p) ^ mask);
   return p;
 }
 
 inline void* UnmaskPtr(void* p) {
   return MaskPtr(p);
 }
 
 // Returns value of the |previous| pointer w/out running a sanity
 // check.
 inline void *FL_Previous_No_Check(void *t) {
@@ skipping 138 matching lines @@
 
 namespace {
 
 inline void FL_SetNext(void *t, void *n) {
   tcmalloc::SLL_SetNext(t,n);
 }
 
 }
 
 #endif // TCMALLOC_USE_DOUBLYLINKED_FREELIST