Oilpan: HeapObjectHeader::checkHeader should not allow access on orphaned pages

Source/platform/heap/TraceTraits.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef TraceTraits_h
 #define TraceTraits_h
 
 #include "platform/heap/GCInfo.h"
 #include "platform/heap/Heap.h"
 #include "platform/heap/InlinedGlobalMarkingVisitor.h"
@@ skipping 381 matching lines @@
         static_assert(!ShouldBeTraced<Traits>::value || Traits::canInitializeWithMemset || WTF::IsPolymorphic<T>::value, "HeapVectorBacking doesn't support objects that cannot be initialized with memset.");
 
         // This trace method is instantiated for vectors where
         // ShouldBeTraced<Traits>::value is false, but the trace method
         // should not be called. Thus we cannot static-assert
         // ShouldBeTraced<Traits>::value but should runtime-assert it.
         ASSERT(ShouldBeTraced<Traits>::value);
 
         T* array = reinterpret_cast<T*>(self);
         blink::HeapObjectHeader* header = blink::HeapObjectHeader::fromPayload(self);
+        header->checkHeader();
         // Use the payload size as recorded by the heap to determine how many
         // elements to trace.
         size_t length = header->payloadSize() / sizeof(T);
         if (WTF::IsPolymorphic<T>::value) {
             for (size_t i = 0; i < length; ++i) {
                 if (blink::vTableInitialized(&array[i]))
                     blink::TraceIfEnabled<T, ShouldBeTraced<Traits>::value>::trace(visitor, array[i]);
             }
         } else {
 #ifdef ANNOTATE_CONTIGUOUS_CONTAINER
@@ skipping 15 matching lines @@
     using Value = typename Table::ValueType;
     using Traits = typename Table::ValueTraits;
 
     template<typename VisitorDispatcher>
     static bool trace(VisitorDispatcher visitor, void* self)
     {
         static_assert(strongify == WTF::WeakPointersActStrong, "An on-stack HeapHashTable needs to be visited strongly.");
 
         Value* array = reinterpret_cast<Value*>(self);
         blink::HeapObjectHeader* header = blink::HeapObjectHeader::fromPayload(self);
+        header->checkHeader();
         // Use the payload size as recorded by the heap to determine how many
         // elements to trace.
         size_t length = header->payloadSize() / sizeof(Value);
         for (size_t i = 0; i < length; ++i) {
             if (!HashTableHelper<Value, typename Table::ExtractorType, typename Table::KeyTraitsType>::isEmptyOrDeletedBucket(array[i]))
                 blink::TraceCollectionIfEnabled<ShouldBeTraced<Traits>::value, Traits::weakHandlingFlag, strongify, Value, Traits>::trace(visitor, array[i]);
         }
         return false;
     }
 };
 
 // This specialization of TraceInCollectionTrait is for the backing of
 // HeapListHashSet.  This is for the case that we find a reference to the
 // backing from the stack.  That probably means we have a GC while we are in a
 // ListHashSet method since normal API use does not put pointers to the backing
 // on the stack.
 template<ShouldWeakPointersBeMarkedStrongly strongify, typename NodeContents, size_t inlineCapacity, typename T, typename U, typename V, typename W, typename X, typename Y>
 struct TraceInCollectionTrait<NoWeakHandlingInCollections, strongify, blink::HeapHashTableBacking<HashTable<ListHashSetNode<NodeContents, blink::HeapListHashSetAllocator<T, inlineCapacity>>*, U, V, W, X, Y, blink::HeapAllocator>>, void> {
     using Node = ListHashSetNode<NodeContents, blink::HeapListHashSetAllocator<T, inlineCapacity>>;
     using Table = HashTable<Node*, U, V, W, X, Y, blink::HeapAllocator>;
 
     template<typename VisitorDispatcher>
     static bool trace(VisitorDispatcher visitor, void* self)
     {
         Node** array = reinterpret_cast<Node**>(self);
         blink::HeapObjectHeader* header = blink::HeapObjectHeader::fromPayload(self);
+        header->checkHeader();
         size_t length = header->payloadSize() / sizeof(Node*);
         for (size_t i = 0; i < length; ++i) {
             if (!HashTableHelper<Node*, typename Table::ExtractorType, typename Table::KeyTraitsType>::isEmptyOrDeletedBucket(array[i])) {
                 traceListHashSetValue(visitor, array[i]->m_value);
                 // Just mark the node without tracing because we already traced
                 // the contents, and there is no need to trace the next and
                 // prev fields since iterating over the hash table backing will
                 // find the whole chain.
                 visitor->markNoTracing(array[i]);
             }
@@ skipping 93 matching lines @@
         // since iterating over the hash table backing will find the whole
         // chain.
         visitor->markNoTracing(node);
         return false;
     }
 };
 
 } // namespace WTF
 
 #endif