Avoid race on uninitializing CrossThreadPersistent nodes.

third_party/WebKit/Source/platform/heap/Handle.h

Index: third_party/WebKit/Source/platform/heap/Handle.h
diff --git a/third_party/WebKit/Source/platform/heap/Handle.h b/third_party/WebKit/Source/platform/heap/Handle.h
index 69cb7575950ac9f977932624164767e83a43e6da..8036c3bf0b669910d93bd4e705cc389d7775ff38 100644
--- a/third_party/WebKit/Source/platform/heap/Handle.h
+++ b/third_party/WebKit/Source/platform/heap/Handle.h
@@ -240,13 +240,14 @@ private:
 
     void uninitialize()
     {
-        if (!m_persistentNode)
-            return;
-
         if (crossThreadnessConfiguration == CrossThreadPersistentConfiguration) {
-            ProcessHeap::crossThreadPersistentRegion().freePersistentNode(m_persistentNode);
+            if (acquireLoad(reinterpret_cast<void* volatile*>(&m_persistentNode)))
+                ProcessHeap::crossThreadPersistentRegion().freePersistentNode(m_persistentNode);
             return;
         }
+
+        if (!m_persistentNode)
+            return;
         ThreadState* state = ThreadStateFor<ThreadingTrait<T>::Affinity>::state();
         ASSERT(state->checkThread());
         // Persistent handle must be created and destructed in the same thread.