Chrome Version: tip
OS: Linux x86-64

What steps will reproduce the problem?
(1) Build blink_heap_unittests with Control Flow Integrity enabled:

GYP_DEFINES='buildtype=Official' gclient sync
gn gen out/cfi '--args=is_debug=false is_cfi=true use_cfi_cast=true use_cfi_diag=true' --check
ninja -C out/cfi blink_heap_unittests


(2) Run the test:
$ ./out/cfi-tot/blink_heap_unittests --gtest_filter=HeapTest.VectorDestructorsWithVtable
IMPORTANT DEBUGGING NOTE: batches of tests are run inside their
own process. For debugging a test inside a debugger, use the
--gtest_filter=<your_test_name> flag along with
--single-process-tests.
Using sharding settings from environment. This is shard 0/1
Using 1 parallel jobs.
Note: Google Test filter = HeapTest.VectorDestructorsWithVtable
[==========] Running 1 test from 1 test case.
[----------] Global test environment set-up.
[----------] 1 test from HeapTest
[ RUN      ] HeapTest.VectorDestructorsWithVtable
../../third_party/WebKit/Source/platform/heap/HeapAllocator.h:73:12: runtime error: control flow integrity check for type 'blink::InlinedVectorObjectWithVtable' failed during cast to unrelated type (vtable address 0x000000000000)
0x000000000000: note: invalid vtable
<memory cannot be printed>
../../third_party/WebKit/Source/platform/heap/HeapAllocator.h:98:12: runtime error: control flow integrity check for type 'blink::InlinedVectorObjectWithVtable' failed during cast to unrelated type (vtable address 0x000000000000)
0x000000000000: note: invalid vtable

What happens here is the case of non-allocated memory to a class pointer with virtual a virtual table. CFI check correctly complains about invalid vtable pointer.

This breaks at least one bot:
https://build.chromium.org/p/chromium.fyi/builders/CFI%20Linux%20ToT/builds/6011

We have seen such issues in the past, and the solution is to call New before making a cast to the specific type. In this case, the code becomes correct and functionally equivalent to the desire expressed by the existing code.

I will try to make a fix.