Avoid PageMemoryRegion::m_numPages data race.

third_party/WebKit/Source/platform/heap/PageMemory.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef PageMemory_h
 #define PageMemory_h
 
 #include "platform/heap/HeapPage.h"
 #include "wtf/Allocator.h"
 #include "wtf/Assertions.h"
@@ skipping 41 matching lines @@
 // A PageMemoryRegion represents a chunk of reserved virtual address
 // space containing a number of blink heap pages. On Windows, reserved
 // virtual address space can only be given back to the system as a
 // whole. The PageMemoryRegion allows us to do that by keeping track
 // of the number of pages using it in order to be able to release all
 // of the virtual address space when there are no more pages using it.
 class PageMemoryRegion : public MemoryRegion {
 public:
     ~PageMemoryRegion();
 
-    void pageDeleted(Address page)
-    {
-        markPageUnused(page);
-        if (!--m_numPages)
-            delete this;
-    }
+    void pageDeleted(Address);
 
     void markPageUsed(Address page)
     {
         ASSERT(!m_inUse[index(page)]);
         m_inUse[index(page)] = true;
     }
 
     void markPageUnused(Address page)
     {
         m_inUse[index(page)] = false;
@@ skipping 15 matching lines @@
         if (!m_inUse[index(address)])
             return nullptr;
         if (m_isLargePage)
             return pageFromObject(base());
         return pageFromObject(address);
     }
 
 private:
     PageMemoryRegion(Address base, size_t, unsigned numPages);
 
-    unsigned index(Address address)
+    unsigned index(Address address) const
     {
         ASSERT(contains(address));
         if (m_isLargePage)
             return 0;
         size_t offset = blinkPageAddress(address) - base();
         ASSERT(offset % blinkPageSize == 0);
         return offset / blinkPageSize;
     }
 
     static PageMemoryRegion* allocate(size_t, unsigned numPages);
 
-    bool m_isLargePage;
+    const bool m_isLargePage;
+    // A thread owns a page, but not a region. Represent the in-use
+    // bitmap such that thread non-interference comes for free.
     bool m_inUse[blinkPagesPerRegion];
-    unsigned m_numPages;
+    int m_numPages;
 };
 
 // A RegionTree is a simple binary search tree of PageMemoryRegions sorted
 // by base addresses.
 class RegionTree {
     USING_FAST_MALLOC(RegionTree);
 public:
     explicit RegionTree(PageMemoryRegion* region)
         : m_region(region)
         , m_left(nullptr)
@@ skipping 76 matching lines @@
 private:
     PageMemory(PageMemoryRegion* reserved, const MemoryRegion& writable);
 
     PageMemoryRegion* m_reserved;
     MemoryRegion m_writable;
 };
 
 } // namespace blink
 
 #endif