[base] Add is_alive field to Debug Double Frees in base::Values

This change temporarily adds an "is_alive" flag to base::Value that
should help in debugging use-after-free crashes. This change is
intended to be reverted after a few days in Canary.

Bug: 859477
Change-Id: I6ab51c37db18dd766677ef162fd42cc6832d1bab
Reviewed-on: https://chromium-review.googlesource.com/1163244Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Commit-Queue: Daniel Cheng <dcheng@chromium.org>
Cr-Commit-Position: refs/heads/master@{#581405}

base/values.cc

@@ -76,6 +76,8 @@ std::unique_ptr<Value> CopyWithoutEmptyChildren(const Value& node) {
 
 }  // namespace
 
+constexpr uint32_t Value::kMagicIsAlive;
+
 // static
 std::unique_ptr<Value> Value::CreateWithCopiedBuffer(const char* buffer,
                                                      size_t size) {
@@ -215,6 +217,7 @@ Value Value::Clone() const {
 
 Value::~Value() {
   InternalCleanup();
+  is_alive_ = 0;
 }
 
 // static
@@ -701,6 +704,8 @@ void Value::InternalMoveConstructFrom(Value&& that) {
 }
 
 void Value::InternalCleanup() {
+  CHECK_EQ(is_alive_, kMagicIsAlive);
+
   switch (type_) {
     case Type::NONE:
     case Type::BOOLEAN:

base/values.h

@@ -96,6 +96,10 @@ class BASE_EXPORT Value {
     // Note: Do not add more types. See the file-level comment above for why.
   };
 
+  // Magic IsAlive signature to debug double frees.
+  // TODO(crbug.com/859477): Remove once root cause is found.
+  static constexpr uint32_t kMagicIsAlive = 0x15272f19;
+
   // For situations where you want to keep ownership of your buffer, this
   // factory method creates a new BinaryValue by copying the contents of the
   // buffer that's passed in.
@@ -383,6 +387,10 @@ class BASE_EXPORT Value {
   void InternalMoveConstructFrom(Value&& that);
   void InternalCleanup();
 
+  // IsAlive member to debug double frees.
+  // TODO(crbug.com/859477): Remove once root cause is found.
+  uint32_t is_alive_ = kMagicIsAlive;
+
   DISALLOW_COPY_AND_ASSIGN(Value);
 };