2 files changed, 17 insertions, 2 deletions
diff --git a/third_party/tcmalloc/chromium/src/free_list.cc b/third_party/tcmalloc/chromium/src/free_list.cc
index 26243c6..12f9b96 100644
--- a/third_party/tcmalloc/chromium/src/free_list.cc
+++ b/third_party/tcmalloc/chromium/src/free_list.cc
@@ -62,12 +62,20 @@
 #ifdef TCMALLOC_USE_DOUBLYLINKED_FREELIST
 
 #include <stddef.h>
-#include "internal_logging.h" //for ASSERT
+#include "free_list.h"
 
+// TODO(jar): We should use C++ rather than a macro here.
 #define MEMORY_CHECK(v1, v2) \
   if (v1 != v2) CRASH("Memory corruption detected.\n")
 
 namespace {
+void EnsureNonLoop(void* node, void* next) {
+  // We only have time to do minimal checking.  We don't traverse the list, but
+  // only look for an immediate loop (cycle back to ourself).
+  if (node != next) return;
+  CRASH("Circular loop in list detected: %p\n", next);
+}
+
 // Returns value of the |previous| pointer w/out running a sanity
 // check.
 inline void *FL_Previous_No_Check(void *t) {
@@ -88,10 +96,12 @@ void *FL_Previous(void *t) {
 }
 
 inline void FL_SetPrevious(void *t, void *n) {
+  EnsureNonLoop(t, n);
   reinterpret_cast<void**>(t)[1] = n;
 }
 
 inline void FL_SetNext(void *t, void *n) {
+  EnsureNonLoop(t, n);
   reinterpret_cast<void**>(t)[0] = n;
 }
 
diff --git a/third_party/tcmalloc/chromium/src/free_list.h b/third_party/tcmalloc/chromium/src/free_list.h
index e5b9bfd..2b29052 100644
--- a/third_party/tcmalloc/chromium/src/free_list.h
+++ b/third_party/tcmalloc/chromium/src/free_list.h
@@ -40,6 +40,7 @@
 #define TCMALLOC_FREE_LIST_H_
 
 #include <stddef.h>
+#include "internal_logging.h"  // For CRASH() macro.
 #include "linked_list.h"
 
 namespace tcmalloc {
@@ -69,7 +70,11 @@ inline void FL_Init(void *t) {
 }
 
 inline void FL_Push(void **list, void *element) {
-  SLL_Push(list,element);
+  if(*list != element) {
+    SLL_Push(list,element);
+    return;
+  }
+  CRASH("Double Free of %p detected", element);
 }
 
 inline void *FL_Pop(void **list) {