Avoid data race on CrossThreadPersistents during thread detachment.

third_party/WebKit/Source/platform/heap/Handle.h

 /*
  * Copyright (C) 2014 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 21 matching lines @@
 #define Handle_h
 
 #include "platform/heap/Heap.h"
 #include "platform/heap/HeapAllocator.h"
 #include "platform/heap/InlinedGlobalMarkingVisitor.h"
 #include "platform/heap/PersistentNode.h"
 #include "platform/heap/ThreadState.h"
 #include "platform/heap/TraceTraits.h"
 #include "platform/heap/Visitor.h"
 #include "wtf/Allocator.h"
+#include "wtf/Atomics.h"
 #include "wtf/Functional.h"
 #include "wtf/HashFunctions.h"
 #include "wtf/Locker.h"
 #include "wtf/MainThread.h"
 #include "wtf/RawPtr.h"
 #include "wtf/RefCounted.h"
 #include "wtf/TypeTraits.h"
 
 #if defined(LEAK_SANITIZER)
 #include "wtf/LeakAnnotations.h"
@@ skipping 151 matching lines @@
     {
         if (m_persistentNode) {
             ASSERT(ThreadState::current());
             ThreadState::current()->registerStaticPersistentNode(m_persistentNode);
             LEAK_SANITIZER_IGNORE_OBJECT(this);
         }
         return this;
     }
 #endif
 
+protected:
+    T* atomicGet() { return reinterpret_cast<T*>(acquireLoad(reinterpret_cast<void* volatile*>(&m_raw))); }
+
 private:
     NO_LAZY_SWEEP_SANITIZE_ADDRESS
     void assign(T* ptr)
     {
-        m_raw = ptr;
+        if (crossThreadnessConfiguration == CrossThreadPersistentConfiguration)
+            releaseStore(reinterpret_cast<void* volatile*>(&m_raw), ptr);
+        else
+            m_raw = ptr;
         checkPointer();
         if (m_raw) {
             if (!m_persistentNode)
                 initialize();
             return;
         }
         if (m_persistentNode && crossThreadnessConfiguration != CrossThreadPersistentConfiguration)
             uninitialize();
     }
 
@@ skipping 202 matching lines @@
     CrossThreadPersistent(T* raw) : Parent(raw) { }
     CrossThreadPersistent(T& raw) : Parent(raw) { }
     CrossThreadPersistent(const CrossThreadPersistent& other) : Parent(other) { }
     template<typename U>
     CrossThreadPersistent(const CrossThreadPersistent<U>& other) : Parent(other) { }
     template<typename U>
     CrossThreadPersistent(const Member<U>& other) : Parent(other) { }
     template<typename U>
     CrossThreadPersistent(const RawPtr<U>& other) : Parent(other.get()) { }
 
+    T* atomicGet() { return Parent::atomicGet(); }
+
     template<typename U>
     CrossThreadPersistent& operator=(U* other)
     {
         Parent::operator=(other);
         return *this;
     }
 
     CrossThreadPersistent& operator=(std::nullptr_t)
     {
         Parent::operator=(nullptr);
@@ skipping 1007 matching lines @@
     // into it.
     //
     // TODO(sof): remove this hack once wtf/Functional.h can also work with a type like
     // CrossThreadWeakPersistent<>.
     static WeakPtr<T> unwrap(const StorageType& value) { return WeakPtr<T>(WeakReference<T>::create(value.get())); }
 };
 
 } // namespace WTF
 
 #endif