Oilpan: Add a checkHeader ASSERT to HeapObjectHeader::fromPayload

Source/platform/heap/Heap.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 225 matching lines @@
     //
     // | HeapHeaderObject (4 byte) | object payload (8 * n byte) | padding (4 byte) |
     // ^4 byte aligned             ^8 byte aligned               ^4 byte aligned
     //
     // since the former layout aligns both header and payload to 8 byte.
 #if !ENABLE(ASSERT) && !ENABLE(GC_PROFILING) && CPU(64BIT)
     uint32_t m_padding;
 #endif
 };
 
-inline HeapObjectHeader* HeapObjectHeader::fromPayload(const void* payload)
-{
-    Address addr = reinterpret_cast<Address>(const_cast<void*>(payload));
-    HeapObjectHeader* header = reinterpret_cast<HeapObjectHeader*>(addr - sizeof(HeapObjectHeader));
-    return header;
-}
-
 class FreeListEntry final : public HeapObjectHeader {
 public:
     NO_SANITIZE_ADDRESS
     explicit FreeListEntry(size_t size)
         : HeapObjectHeader(size, gcInfoIndexForFreeListHeader)
         , m_next(nullptr)
     {
 #if ENABLE(ASSERT) && !defined(ADDRESS_SANITIZER)
         // Zap free area with asterisks, aka 0x2a2a2a2a.
         // For ASan don't zap since we keep accounting in the freelist entry.
@@ skipping 919 matching lines @@
 {
     size_t size = m_encoded & headerSizeMask;
     if (UNLIKELY(size == largeObjectSizeInHeader)) {
         ASSERT(pageFromObject(this)->isLargeObjectPage());
         return static_cast<LargeObjectPage*>(pageFromObject(this))->payloadSize();
     }
     ASSERT(!pageFromObject(this)->isLargeObjectPage());
     return size - sizeof(HeapObjectHeader);
 }
 
+inline HeapObjectHeader* HeapObjectHeader::fromPayload(const void* payload)
+{
+    Address addr = reinterpret_cast<Address>(const_cast<void*>(payload));
+    HeapObjectHeader* header = reinterpret_cast<HeapObjectHeader*>(addr - sizeof(HeapObjectHeader));
+    header->checkHeader();
+    return header;
+}
+
 NO_SANITIZE_ADDRESS inline
 bool HeapObjectHeader::isMarked() const
 {
     checkHeader();
     return m_encoded & headerMarkBitMask;
 }
 
 NO_SANITIZE_ADDRESS inline
 void HeapObjectHeader::mark()
 {
@@ skipping 91 matching lines @@
     size_t copySize = previousHeader->payloadSize();
     if (copySize > size)
         copySize = size;
     memcpy(address, previous, copySize);
     return address;
 }
 
 } // namespace blink
 
 #endif // Heap_h