Avoid race on uninitializing CrossThreadPersistent nodes.

third_party/WebKit/Source/platform/heap/PersistentNode.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef PersistentNode_h
 #define PersistentNode_h
 
 #include "platform/PlatformExport.h"
 #include "platform/heap/ThreadState.h"
 #include "wtf/Allocator.h"
@@ skipping 159 matching lines @@
 };
 
 class CrossThreadPersistentRegion final {
     USING_FAST_MALLOC(CrossThreadPersistentRegion);
 public:
     CrossThreadPersistentRegion() : m_persistentRegion(adoptPtr(new PersistentRegion)) { }
 
     void allocatePersistentNode(PersistentNode*& persistentNode, void* self, TraceCallback trace)
     {
         MutexLocker lock(m_mutex);
-        persistentNode = m_persistentRegion->allocatePersistentNode(self, trace);
+        PersistentNode* node = m_persistentRegion->allocatePersistentNode(self, trace);
+        releaseStore(reinterpret_cast<void* volatile*>(&persistentNode), node);
     }
 
     void freePersistentNode(PersistentNode*& persistentNode)
     {
         MutexLocker lock(m_mutex);
         // When the thread that holds the heap object that the cross-thread persistent shuts down,
         // prepareForThreadStateTermination() will clear out the associated CrossThreadPersistent<>
         // and PersistentNode so as to avoid unsafe access. This can overlap with a holder of
         // the CrossThreadPersistent<> also clearing the persistent and freeing the PersistentNode.
         //
         // The lock ensures the updating is ordered, but by the time lock has been acquired the
         // PersistentNode reference may have been cleared out already; check for this.
         if (!persistentNode)
             return;
         m_persistentRegion->freePersistentNode(persistentNode);
-        persistentNode = nullptr;
+        releaseStore(reinterpret_cast<void* volatile*>(&persistentNode), nullptr);
     }
 
     void tracePersistentNodes(Visitor* visitor)
     {
         MutexLocker lock(m_mutex);
         m_persistentRegion->tracePersistentNodes(visitor, CrossThreadPersistentRegion::shouldTracePersistentNode);
     }
 
     void prepareForThreadStateTermination(ThreadState*);
 
     static bool shouldTracePersistentNode(Visitor*, PersistentNode*);
 
 private:
     // We don't make CrossThreadPersistentRegion inherit from PersistentRegion
     // because we don't want to virtualize performance-sensitive methods
     // such as PersistentRegion::allocate/freePersistentNode.
     OwnPtr<PersistentRegion> m_persistentRegion;
 
     // Recursive as prepareForThreadStateTermination() clears a PersistentNode's
     // associated Persistent<> -- it in turn freeing the PersistentNode. And both
     // CrossThreadPersistentRegion operations need a lock on the region before
     // mutating.
     RecursiveMutex m_mutex;
 };
 
 } // namespace blink
 
 #endif