Lock CrossThreadPersistentRegion until end of weak processing.

third_party/WebKit/Source/platform/heap/Heap.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 498 matching lines @@
     ThreadState::NoAllocationScope noAllocationScope(state);
 
     state->heap().preGC();
 
     StackFrameDepthScope stackDepthScope;
 
     size_t totalObjectSize = state->heap().heapStats().allocatedObjectSize() + state->heap().heapStats().markedObjectSize();
     if (gcType != BlinkGC::TakeSnapshot)
         state->heap().resetHeapCounters();
 
-    // 1. Trace persistent roots.
-    state->heap().visitPersistentRoots(visitor.get());
+    {
+        // Access to the CrossThreadPersistentRegion has to be prevented while
+        // marking and global weak processing is in progress. If not, threads
+        // not attached to Oilpan and participating in this GC are able
+        // to allocate & free PersistentNodes, something the marking phase isn't
+        // capable of handling.
+        CrossThreadPersistentRegion::LockScope persistentLock(ProcessHeap::crossThreadPersistentRegion());
 
-    // 2. Trace objects reachable from the stack.  We do this independent of the
-    // given stackState since other threads might have a different stack state.
-    state->heap().visitStackRoots(visitor.get());
+        // 1. Trace persistent roots.
+        state->heap().visitPersistentRoots(visitor.get());
 
-    // 3. Transitive closure to trace objects including ephemerons.
-    state->heap().processMarkingStack(visitor.get());
+        // 2. Trace objects reachable from the stack.  We do this independent of the
+        // given stackState since other threads might have a different stack state.
+        state->heap().visitStackRoots(visitor.get());
 
-    state->heap().postMarkingProcessing(visitor.get());
-    state->heap().globalWeakProcessing(visitor.get());
+        // 3. Transitive closure to trace objects including ephemerons.
+        state->heap().processMarkingStack(visitor.get());
+
+        state->heap().postMarkingProcessing(visitor.get());
+        state->heap().globalWeakProcessing(visitor.get());
+    }
 
     // Now we can delete all orphaned pages because there are no dangling
     // pointers to the orphaned pages.  (If we have such dangling pointers,
     // we should have crashed during marking before getting here.)
     state->heap().getOrphanedPagePool()->decommitOrphanedPages();
 
     double markingTimeInMilliseconds = WTF::currentTimeMS() - startTime;
     state->heap().heapStats().setEstimatedMarkingTimePerByte(totalObjectSize ? (markingTimeInMilliseconds / 1000 / totalObjectSize) : 0);
 
 #if PRINT_HEAP_STATS
@@ skipping 242 matching lines @@
     ProcessHeap::decreaseTotalMarkedObjectSize(m_stats.markedObjectSize());
 
     m_stats.reset();
     for (ThreadState* state : m_threads)
         state->resetHeapCounters();
 }
 
 ThreadHeap* ThreadHeap::s_mainThreadHeap = nullptr;
 
 } // namespace blink