Lock CrossThreadPersistentRegion while poisoning HeapPages

third_party/WebKit/Source/platform/heap/ThreadState.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 1119 matching lines @@
     // Eager sweeping should happen only in testing.
     completeSweep();
   } else {
     // The default behavior is lazy sweeping.
     scheduleIdleLazySweep();
   }
 }
 
 #if defined(ADDRESS_SANITIZER)
 void ThreadState::poisonAllHeaps() {
+  CrossThreadPersistentRegion::LockScope persistentLock(
+      ProcessHeap::crossThreadPersistentRegion());
   // Poisoning all unmarked objects in the other arenas.
   for (int i = 1; i < BlinkGC::NumberOfArenas; i++)
     m_arenas[i]->poisonArena();
   // CrossThreadPersistents in unmarked objects may be accessed from other
   // threads (e.g. in CrossThreadPersistentRegion::shouldTracePersistent) and
   // that would be fine.
   ProcessHeap::crossThreadPersistentRegion().unpoisonCrossThreadPersistents();
 }
 
 void ThreadState::poisonEagerArena() {
+  CrossThreadPersistentRegion::LockScope persistentLock(
+      ProcessHeap::crossThreadPersistentRegion());
   m_arenas[BlinkGC::EagerSweepArenaIndex]->poisonArena();
   // CrossThreadPersistents in unmarked objects may be accessed from other
   // threads (e.g. in CrossThreadPersistentRegion::shouldTracePersistent) and
   // that would be fine.
   ProcessHeap::crossThreadPersistentRegion().unpoisonCrossThreadPersistents();
 }
 #endif
 
 void ThreadState::eagerSweep() {
 #if defined(ADDRESS_SANITIZER)
@@ skipping 661 matching lines @@
     collectGarbage(BlinkGC::NoHeapPointersOnStack, BlinkGC::GCWithSweep,
                    BlinkGC::ForcedGC);
     size_t liveObjects = heap().heapStats().markedObjectSize();
     if (liveObjects == previousLiveObjects)
       break;
     previousLiveObjects = liveObjects;
   }
 }
 
 }  // namespace blink