Avoid race on uninitializing CrossThreadPersistent nodes.

third_party/WebKit/Source/platform/heap/Handle.h

 /*
  * Copyright (C) 2014 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 222 matching lines @@
         ThreadState* state = ThreadStateFor<ThreadingTrait<T>::Affinity>::state();
         ASSERT(state->checkThread());
         m_persistentNode = state->getPersistentRegion()->allocatePersistentNode(this, traceCallback);
 #if ENABLE(ASSERT)
         m_state = state;
 #endif
     }
 
     void uninitialize()
     {
+        if (crossThreadnessConfiguration == CrossThreadPersistentConfiguration) {
+            if (acquireLoad(reinterpret_cast<void* volatile*>(&m_persistentNode)))
+                ProcessHeap::crossThreadPersistentRegion().freePersistentNode(m_persistentNode);
+            return;
+        }
+
         if (!m_persistentNode)
             return;
-
-        if (crossThreadnessConfiguration == CrossThreadPersistentConfiguration) {
-            ProcessHeap::crossThreadPersistentRegion().freePersistentNode(m_persistentNode);
-            return;
-        }
         ThreadState* state = ThreadStateFor<ThreadingTrait<T>::Affinity>::state();
         ASSERT(state->checkThread());
         // Persistent handle must be created and destructed in the same thread.
         ASSERT(m_state == state);
         state->freePersistentNode(m_persistentNode);
         m_persistentNode = nullptr;
     }
 
     void checkPointer()
     {
@@ skipping 953 matching lines @@
     // into it.
     //
     // TODO(sof): remove this hack once wtf/Functional.h can also work with a type like
     // CrossThreadWeakPersistent<>.
     static WeakPtr<T> unwrap(const StorageType& value) { return WeakPtr<T>(WeakReference<T>::create(value.get())); }
 };
 
 } // namespace WTF
 
 #endif