Add extra validation to MetaAllocator::findAndRemoveFreeSpace

https://bugs.webkit.org/show_bug.cgi?id=217792
<rdar://problem/69433015>

Reviewed Saam Barati.

* wtf/MetaAllocator.cpp:
(WTF::MetaAllocator::findAndRemoveFreeSpace):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@269019 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Author: [email protected]

Source/WTF/ChangeLog

@@ -1,3 +1,14 @@
+2020-10-15  Tadeu Zagallo  <[email protected]>
+
+        Add extra validation to MetaAllocator::findAndRemoveFreeSpace
+        https://bugs.webkit.org/show_bug.cgi?id=217792
+        <rdar://problem/69433015>
+
+        Reviewed Saam Barati.
+
+        * wtf/MetaAllocator.cpp:
+        (WTF::MetaAllocator::findAndRemoveFreeSpace):
+
 2020-10-13  Tadeu Zagallo  <[email protected]>
 
         Assert that WTF::HashTable does not visit the same bucket twice

Source/WTF/wtf/MetaAllocator.cpp

@@ -211,7 +211,7 @@ MetaAllocator::FreeSpacePtr MetaAllocator::findAndRemoveFreeSpace(size_t sizeInB
         return nullptr;
 
     size_t nodeSizeInBytes = node->sizeInBytes();
-    ASSERT(nodeSizeInBytes >= sizeInBytes);
+    RELEASE_ASSERT(nodeSizeInBytes >= sizeInBytes);
 
     m_freeSpaceSizeMap.remove(node);
 
@@ -246,6 +246,7 @@ MetaAllocator::FreeSpacePtr MetaAllocator::findAndRemoveFreeSpace(size_t sizeInB
             m_freeSpaceStartAddressMap.remove(node->m_start);
 
             node->m_start += sizeInBytes;
+            RELEASE_ASSERT(nodeStartAsInt < node->m_start.untaggedPtr<uintptr_t>() && node->m_start.untaggedPtr<uintptr_t>() < node->m_end.untaggedPtr<uintptr_t>());
 
             m_freeSpaceSizeMap.insert(node);
             m_freeSpaceStartAddressMap.add(node->m_start, node);