Fix data race in blink::ThreadHeap::detach

third_party/WebKit/Source/platform/heap/Heap.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 243 matching lines @@
 
 void ThreadHeap::attach(ThreadState* thread)
 {
     MutexLocker locker(m_threadAttachMutex);
     m_threads.add(thread);
 }
 
 void ThreadHeap::detach(ThreadState* thread)
 {
     ASSERT(ThreadState::current() == thread);
+    bool isLastThread = false;
     {
         // Grab the threadAttachMutex to ensure only one thread can shutdown at
         // a time and that no other thread can do a global GC. It also allows
         // safe iteration of the m_threads set which happens as part of
         // thread local GC asserts. We enter a safepoint while waiting for the
         // lock to avoid a dead-lock where another thread has already requested
         // GC.
         SafePointAwareMutexLocker locker(m_threadAttachMutex, BlinkGC::NoHeapPointersOnStack);
         thread->runTerminationGC();
         ASSERT(m_threads.contains(thread));
         m_threads.remove(thread);
+        isLastThread = m_threads.isEmpty();
     }
-    // The main thread must be the last thread that gets detached.
-    ASSERT(!thread->isMainThread() || m_threads.isEmpty());
+    // The last thread begin detached should be the owning thread, which would
+    // be the main thread for the mainThreadHeap and a per thread heap enabled
+    // thread otherwise.
+    if (isLastThread)
+        DCHECK(thread->perThreadHeapEnabled() || thread->isMainThread());
     if (thread->isMainThread())
         DCHECK_EQ(heapStats().allocatedSpace(), 0u);
-    if (m_threads.isEmpty())
+    if (isLastThread)
         delete this;
 }
 
 bool ThreadHeap::park()
 {
     return m_safePointBarrier->parkOthers();
 }
 
 void ThreadHeap::resume()
 {
@@ skipping 498 matching lines @@
     ProcessHeap::decreaseTotalMarkedObjectSize(m_stats.markedObjectSize());
 
     m_stats.reset();
     for (ThreadState* state : m_threads)
         state->resetHeapCounters();
 }
 
 ThreadHeap* ThreadHeap::s_mainThreadHeap = nullptr;
 
 } // namespace blink