Lock CrossThreadPersistentRegion until end of weak processing.

third_party/WebKit/Source/platform/heap/Heap.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 445 matching lines @@
     ThreadState::NoAllocationScope noAllocationScope(state);
 
     preGC();
 
     StackFrameDepthScope stackDepthScope;
 
     size_t totalObjectSize = Heap::heapStats().allocatedObjectSize() + Heap::heapStats().markedObjectSize();
     if (gcType != BlinkGC::TakeSnapshot)
         Heap::resetHeapCounters();
 
-    // 1. Trace persistent roots.
-    ThreadState::visitPersistentRoots(visitor.get());
+    {
+        // Access to the CrossThreadPersistentRegion has to be prevented while
+        // marking and global weak processing is in progress. If not, threads
+        // not attached to Oilpan and participating in this GC are able
+        // to allocate & free PersistentNodes, something the marking phase isn't
+        // capable of handling.
+        CrossThreadPersistentRegion::LockScope persistentLock(ProcessHeap::crossThreadPersistentRegion());
 
-    // 2. Trace objects reachable from the stack.  We do this independent of the
-    // given stackState since other threads might have a different stack state.
-    ThreadState::visitStackRoots(visitor.get());
+        // 1. Trace persistent roots.
+        ThreadState::visitPersistentRoots(visitor.get());
 
-    // 3. Transitive closure to trace objects including ephemerons.
-    processMarkingStack(visitor.get());
+        // 2. Trace objects reachable from the stack.  We do this independent of the
+        // given stackState since other threads might have a different stack state.
+        ThreadState::visitStackRoots(visitor.get());
 
-    postMarkingProcessing(visitor.get());
-    globalWeakProcessing(visitor.get());
+        // 3. Transitive closure to trace objects including ephemerons.
+        processMarkingStack(visitor.get());
+
+        postMarkingProcessing(visitor.get());
+        globalWeakProcessing(visitor.get());
+    }
 
     // Now we can delete all orphaned pages because there are no dangling
     // pointers to the orphaned pages.  (If we have such dangling pointers,
     // we should have crashed during marking before getting here.)
     getOrphanedPagePool()->decommitOrphanedPages();
 
     double markingTimeInMilliseconds = WTF::currentTimeMS() - startTime;
     Heap::heapStats().setEstimatedMarkingTimePerByte(totalObjectSize ? (markingTimeInMilliseconds / 1000 / totalObjectSize) : 0);
 
 #if PRINT_HEAP_STATS
@@ skipping 223 matching lines @@
 CallbackStack* Heap::s_postMarkingCallbackStack;
 CallbackStack* Heap::s_globalWeakCallbackStack;
 CallbackStack* Heap::s_ephemeronStack;
 HeapDoesNotContainCache* Heap::s_heapDoesNotContainCache;
 FreePagePool* Heap::s_freePagePool;
 OrphanedPagePool* Heap::s_orphanedPagePool;
 
 BlinkGC::GCReason Heap::s_lastGCReason = BlinkGC::NumberOfGCReason;
 
 } // namespace blink