Fix race in deletion of native message handlers (fixes #28484).

runtime/vm/pages.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/pages.h"
 
 #include "platform/assert.h"
 #include "vm/compiler_stats.h"
 #include "vm/gc_marker.h"
 #include "vm/gc_sweeper.h"
@@ skipping 71 matching lines @@
   HeapPage* result = Initialize(memory, type);
   if (result == NULL) {
     delete memory;  // Release reservation to OS.
     return NULL;
   }
   return result;
 }
 
 
 void HeapPage::Deallocate() {
-  // The memory for this object will become unavailable after the delete below.
+  // For a regular heap pages, the memory for this object will become
+  // unavailable after the delete below.
+  bool is_embedder_allocated = embedder_allocated();
   delete memory_;
+
+  // For a heap page from a snapshot, the HeapPage object lives in the malloc
+  // heap rather than the page itself.
+  if (is_embedder_allocated) {
+    free(this);

[Florian Schneider, 2017/01/24 02:06:07]

Maybe change this to new/delete instead of malloc/free.

[rmacnak, 2017/01/24 03:28:36]

Trying this out, I see the original reason this uses malloc is to avoid removing
DISALLOW_ALLOCATION, etc from HeapPage. Doing so would give a false impression
that the constructor always runs, which it still wouldn't when normal heap pages
are allocated by reinterpret-casting the  mmap'd page.

+  }
 }
 
 
 void HeapPage::VisitObjects(ObjectVisitor* visitor) const {
   NoSafepointScope no_safepoint;
   uword obj_addr = object_start();
   uword end_addr = object_end();
   while (obj_addr < end_addr) {
     RawObject* raw_obj = RawObject::FromAddr(obj_addr);
     visitor->VisitObject(raw_obj);
@@ skipping 1179 matching lines @@
     return 0;
   } else {
     ASSERT(total_time >= gc_time);
     int result = static_cast<int>(
         (static_cast<double>(gc_time) / static_cast<double>(total_time)) * 100);
     return result;
   }
 }
 
 }  // namespace dart