Code:  void NormalPageArena::promptlyFreeObject(HeapObjectHeader* header) {
   ASSERT(!getThreadState()->sweepForbidden());
  ASSERT(header->checkHeader());
   Address address = reinterpret_cast<Address>(header);
   Address payload = header->payload();
   size_t size = header->size();
  size_t payloadSize = header->payloadSize();
  ASSERT(size > 0);
  ASSERT(pageFromObject(address) == findPageFromAddress(address));

  {
    ThreadState::SweepForbiddenScope forbiddenScope(getThreadState());
    header->finalize(payload, payloadSize);
    if (address + size == m_currentAllocationPoint) {
      m_currentAllocationPoint = address;
      setRemainingAllocationSize(m_remainingAllocationSize + size);
      SET_MEMORY_INACCESSIBLE(address, size);
      return;
    }
    SET_MEMORY_INACCESSIBLE(payload, payloadSize);
    header->markPromptlyFreed();
  }

  m_promptlyFreedSize += size;
}

Vulnerability Type: Overflow 
CWE ID: CWE-119
Summary: Inline metadata in GarbageCollection in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Commit Message: Call HeapObjectHeader::checkHeader solely for its side-effect.

This requires changing its signature. This is a preliminary stage to making it
private.

BUG=633030

Review-Url: https://codereview.chromium.org/2698673003
Cr-Commit-Position: refs/heads/master@{#460489}