Make reallocation of large objects reliable.

third_party/WebKit/Source/platform/heap/Heap.h

Index: third_party/WebKit/Source/platform/heap/Heap.h
diff --git a/third_party/WebKit/Source/platform/heap/Heap.h b/third_party/WebKit/Source/platform/heap/Heap.h
index 509c3c8433425c715f4f4b742206b408f57c21e3..e3b7bf09c8f218d57ef52c633fa6a3bf5c0ded0e 100644
--- a/third_party/WebKit/Source/platform/heap/Heap.h
+++ b/third_party/WebKit/Source/platform/heap/Heap.h
@@ -574,18 +574,29 @@ Address ThreadHeap::reallocate(void* previous, size_t size)
     HeapObjectHeader* previousHeader = HeapObjectHeader::fromPayload(previous);
     BasePage* page = pageFromObject(previousHeader);
     ASSERT(page);
-    int arenaIndex = page->arena()->arenaIndex();
-    // Recompute the effective heap index if previous allocation
-    // was on the normal arenas or a large object.
-    if (isNormalArenaIndex(arenaIndex) || arenaIndex == BlinkGC::LargeObjectArenaIndex)
-        arenaIndex = arenaIndexForObjectSize(size);
 
+    // Determine arena index of new allocation.
+    int arenaIndex;
+    if (size >= largeObjectSizeThreshold) {
+        arenaIndex = BlinkGC::LargeObjectArenaIndex;
+    } else {
+        arenaIndex = page->arena()->arenaIndex();
+        if (isNormalArenaIndex(arenaIndex) || arenaIndex == BlinkGC::LargeObjectArenaIndex)
+            arenaIndex = arenaIndexForObjectSize(size);
+    }
+
+    size_t gcInfoIndex = GCInfoTrait<T>::index();
     // TODO(haraken): We don't support reallocate() for finalizable objects.
     ASSERT(!ThreadHeap::gcInfo(previousHeader->gcInfoIndex())->hasFinalizer());
-    ASSERT(previousHeader->gcInfoIndex() == GCInfoTrait<T>::index());
-    const char* typeName = WTF_HEAP_PROFILER_TYPE_NAME(T);
+    ASSERT(previousHeader->gcInfoIndex() == gcInfoIndex);
     HeapAllocHooks::freeHookIfEnabled(static_cast<Address>(previous));
-    Address address = ThreadHeap::allocateOnArenaIndex(state, size, arenaIndex, GCInfoTrait<T>::index(), typeName);
+    Address address;
+    if (arenaIndex == BlinkGC::LargeObjectArenaIndex) {
+        address = page->arena()->allocateLargeObject(allocationSizeFromSize(size), gcInfoIndex);
+    } else {
+        const char* typeName = WTF_HEAP_PROFILER_TYPE_NAME(T);
+        address = ThreadHeap::allocateOnArenaIndex(state, size, arenaIndex, gcInfoIndex, typeName);
+    }
     size_t copySize = previousHeader->payloadSize();
     if (copySize > size)
         copySize = size;