Make reallocation of large objects reliable.

third_party/WebKit/Source/platform/heap/Heap.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 556 matching lines @@
     // TODO(sof): promptly free the previous object.
     if (!size) {
         // If the new size is 0 this is considered equivalent to free(previous).
         return nullptr;
     }
 
     ThreadState* state = ThreadStateFor<ThreadingTrait<T>::Affinity>::state();
     HeapObjectHeader* previousHeader = HeapObjectHeader::fromPayload(previous);
     BasePage* page = pageFromObject(previousHeader);
     ASSERT(page);
-    int arenaIndex = page->arena()->arenaIndex();
-    // Recompute the effective heap index if previous allocation
-    // was on the normal arenas or a large object.
-    if (isNormalArenaIndex(arenaIndex) || arenaIndex == BlinkGC::LargeObjectArenaIndex)
-        arenaIndex = arenaIndexForObjectSize(size);
 
+    // Determine arena index of new allocation.
+    int arenaIndex;
+    if (size >= largeObjectSizeThreshold) {
+        arenaIndex = BlinkGC::LargeObjectArenaIndex;
+    } else {
+        arenaIndex = page->arena()->arenaIndex();
+        if (isNormalArenaIndex(arenaIndex) || arenaIndex == BlinkGC::LargeObjectArenaIndex)
+            arenaIndex = arenaIndexForObjectSize(size);
+    }
+
+    size_t gcInfoIndex = GCInfoTrait<T>::index();
     // TODO(haraken): We don't support reallocate() for finalizable objects.
     ASSERT(!ThreadHeap::gcInfo(previousHeader->gcInfoIndex())->hasFinalizer());
-    ASSERT(previousHeader->gcInfoIndex() == GCInfoTrait<T>::index());
-    const char* typeName = WTF_HEAP_PROFILER_TYPE_NAME(T);
+    ASSERT(previousHeader->gcInfoIndex() == gcInfoIndex);
     HeapAllocHooks::freeHookIfEnabled(static_cast<Address>(previous));
-    Address address = ThreadHeap::allocateOnArenaIndex(state, size, arenaIndex, GCInfoTrait<T>::index(), typeName);
+    Address address;
+    if (arenaIndex == BlinkGC::LargeObjectArenaIndex) {
+        address = page->arena()->allocateLargeObject(allocationSizeFromSize(size), gcInfoIndex);
+    } else {
+        const char* typeName = WTF_HEAP_PROFILER_TYPE_NAME(T);
+        address = ThreadHeap::allocateOnArenaIndex(state, size, arenaIndex, gcInfoIndex, typeName);
+    }
     size_t copySize = previousHeader->payloadSize();
     if (copySize > size)
         copySize = size;
     memcpy(address, previous, copySize);
     return address;
 }
 
 template<typename Derived>
 template<typename T>
 void VisitorHelper<Derived>::handleWeakCell(Visitor* self, void* object)
 {
     T** cell = reinterpret_cast<T**>(object);
     if (*cell && !ObjectAliveTrait<T>::isHeapObjectAlive(*cell))
         *cell = nullptr;
 }
 
 } // namespace blink
 
 #endif // Heap_h