Handle overlapping CrossThreadPersistent<> releases.

third_party/WebKit/Source/platform/heap/Handle.h

 /*
  * Copyright (C) 2014 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 209 matching lines @@
 
     NO_LAZY_SWEEP_SANITIZE_ADDRESS
     void initialize()
     {
         ASSERT(!m_persistentNode);
         if (!m_raw)
             return;
 
         TraceCallback traceCallback = TraceMethodDelegate<PersistentBase<T, weaknessConfiguration, crossThreadnessConfiguration>, &PersistentBase<T, weaknessConfiguration, crossThreadnessConfiguration>::trace>::trampoline;
         if (crossThreadnessConfiguration == CrossThreadPersistentConfiguration) {
-            m_persistentNode = ProcessHeap::crossThreadPersistentRegion().allocatePersistentNode(this, traceCallback);
-        } else {
-            ThreadState* state = ThreadStateFor<ThreadingTrait<T>::Affinity>::state();
-            ASSERT(state->checkThread());
-            m_persistentNode = state->getPersistentRegion()->allocatePersistentNode(this, traceCallback);
+            ProcessHeap::crossThreadPersistentRegion().allocatePersistentNode(m_persistentNode, this, traceCallback);
+            return;
+        }
+        ThreadState* state = ThreadStateFor<ThreadingTrait<T>::Affinity>::state();
+        ASSERT(state->checkThread());
+        m_persistentNode = state->getPersistentRegion()->allocatePersistentNode(this, traceCallback);
 #if ENABLE(ASSERT)
-            m_state = state;
+        m_state = state;
 #endif
-        }
     }
 
     void uninitialize()
     {
         if (!m_persistentNode)
             return;
 
         if (crossThreadnessConfiguration == CrossThreadPersistentConfiguration) {
             ProcessHeap::crossThreadPersistentRegion().freePersistentNode(m_persistentNode);
-        } else {
-            ThreadState* state = ThreadStateFor<ThreadingTrait<T>::Affinity>::state();
-            ASSERT(state->checkThread());
-            // Persistent handle must be created and destructed in the same thread.
-            ASSERT(m_state == state);
-            state->freePersistentNode(m_persistentNode);
+            return;
         }
+        ThreadState* state = ThreadStateFor<ThreadingTrait<T>::Affinity>::state();
+        ASSERT(state->checkThread());
+        // Persistent handle must be created and destructed in the same thread.
+        ASSERT(m_state == state);
+        state->freePersistentNode(m_persistentNode);
         m_persistentNode = nullptr;
     }
 
     void checkPointer()
     {
 #if ENABLE(ASSERT) && defined(ADDRESS_SANITIZER)
         if (!m_raw)
             return;
 
         // ThreadHeap::isHeapObjectAlive(m_raw) checks that m_raw is a traceable
@@ skipping 948 matching lines @@
     // into it.
     //
     // TODO(sof): remove this hack once wtf/Functional.h can also work with a type like
     // CrossThreadWeakPersistent<>.
     static WeakPtr<T> unwrap(const StorageType& value) { return WeakPtr<T>(WeakReference<T>::create(value.get())); }
 };
 
 } // namespace WTF
 
 #endif