Oilpan: HeapObjectHeader::checkHeader should not allow access on orphaned pages

Source/platform/heap/Heap.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 1146 matching lines @@
     // The actual size of a large object is stored in
     // LargeObjectPage::m_payloadSize.
     ASSERT(result != largeObjectSizeInHeader);
     ASSERT(!pageFromObject(this)->isLargeObjectPage());
     return result;
 }
 
 NO_SANITIZE_ADDRESS inline
 void HeapObjectHeader::checkHeader() const
 {
-    ASSERT(pageFromObject(this)->orphaned() || m_magic == magic);
+    ASSERT(!pageFromObject(this)->orphaned());
+    ASSERT(m_magic == magic);
 }
 
 inline Address HeapObjectHeader::payload()
 {
     return reinterpret_cast<Address>(this) + sizeof(HeapObjectHeader);
 }
 
 inline Address HeapObjectHeader::payloadEnd()
 {
     return reinterpret_cast<Address>(this) + size();
@@ skipping 115 matching lines @@
     size_t copySize = previousHeader->payloadSize();
     if (copySize > size)
         copySize = size;
     memcpy(address, previous, copySize);
     return address;
 }
 
 } // namespace blink
 
 #endif // Heap_h