Avoid PageMemoryRegion::m_numPages data race.

third_party/WebKit/Source/platform/heap/PageMemory.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "platform/heap/PageMemory.h"
 
 #include "platform/heap/Heap.h"
 #include "wtf/Assertions.h"
+#include "wtf/Atomics.h"
 #include "wtf/PageAllocator.h"
 
 namespace blink {
 
 void MemoryRegion::release()
 {
     WTF::freePages(m_base, m_size);
 }
 
 bool MemoryRegion::commit()
@@ skipping 18 matching lines @@
     for (size_t i = 0; i < blinkPagesPerRegion; ++i)
         m_inUse[i] = false;
 }
 
 PageMemoryRegion::~PageMemoryRegion()
 {
     Heap::removePageMemoryRegion(this);
     release();
 }
 
+void PageMemoryRegion::pageDeleted(Address page)
+{
+    markPageUnused(page);
+    if (!atomicDecrement(&m_numPages))
+        delete this;
+}
+
 // TODO(haraken): Like partitionOutOfMemoryWithLotsOfUncommitedPages(),
 // we should probably have a way to distinguish physical memory OOM from
 // virtual address space OOM.
 static NEVER_INLINE void blinkGCOutOfMemory()
 {
     IMMEDIATE_CRASH();
 }
 
 PageMemoryRegion* PageMemoryRegion::allocate(size_t size, unsigned numPages)
 {
@@ skipping 99 matching lines @@
     // Overallocate by 2 times OS page size to have space for a
     // guard page at the beginning and end of blink heap page.
     size_t allocationSize = payloadSize + 2 * blinkGuardPageSize;
     PageMemoryRegion* pageMemoryRegion = PageMemoryRegion::allocateLargePage(allocationSize);
     PageMemory* storage = setupPageMemoryInRegion(pageMemoryRegion, 0, payloadSize);
     RELEASE_ASSERT(storage->commit());
     return storage;
 }
 
 } // namespace blink