Sync m_lastRemainingAllocationSize on promptly freeing objects.

Source/platform/heap/HeapPage.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 649 matching lines @@
     size_t size = header->size();
     size_t payloadSize = header->payloadSize();
     ASSERT(size > 0);
     ASSERT(pageFromObject(address) == findPageFromAddress(address));
 
     {
         ThreadState::SweepForbiddenScope forbiddenScope(threadState());
         header->finalize(payload, payloadSize);
         if (address + size == m_currentAllocationPoint) {
             m_currentAllocationPoint = address;
-            if (m_lastRemainingAllocationSize == m_remainingAllocationSize) {
-                Heap::decreaseAllocatedObjectSize(size);
-                m_lastRemainingAllocationSize += size;
-            }
             m_remainingAllocationSize += size;
+            // Sync recorded allocated-object size:
+            //  - if previous alloc checkpoint is larger, allocation size has increased.
+            //  - if smaller, a net reduction in size since last call to updateRemainingAllocationSize().
+            if (m_lastRemainingAllocationSize > m_remainingAllocationSize)
+                Heap::increaseAllocatedObjectSize(m_lastRemainingAllocationSize - m_remainingAllocationSize);
+            else if (m_lastRemainingAllocationSize != m_remainingAllocationSize)
+                Heap::decreaseAllocatedObjectSize(m_remainingAllocationSize - m_lastRemainingAllocationSize);
+            m_lastRemainingAllocationSize = m_remainingAllocationSize;
             SET_MEMORY_INACCESSIBLE(address, size);
             return;
         }
         SET_MEMORY_INACCESSIBLE(payload, payloadSize);
         header->markPromptlyFreed();
     }
 
     m_promptlyFreedSize += size;
 }
 
@@ skipping 1134 matching lines @@
 
     m_hasEntries = true;
     size_t index = hash(address);
     ASSERT(!(index & 1));
     Address cachePage = roundToBlinkPageStart(address);
     m_entries[index + 1] = m_entries[index];
     m_entries[index] = cachePage;
 }
 
 } // namespace blink