CrossThreadPersistent should acquire a lock before assigning

third_party/WebKit/Source/platform/heap/Persistent.h

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef Persistent_h
 #define Persistent_h
 
 #include "platform/heap/Heap.h"
 #include "platform/heap/Member.h"
 #include "platform/heap/PersistentNode.h"
@@ skipping 157 matching lines @@
   NO_SANITIZE_ADDRESS
   T* atomicGet() {
     return reinterpret_cast<T*>(acquireLoad(reinterpret_cast<void* volatile*>(
         const_cast<typename std::remove_const<T>::type**>(&m_raw))));
   }
 
  private:
   NO_SANITIZE_ADDRESS
   void assign(T* ptr) {
     if (crossThreadnessConfiguration == CrossThreadPersistentConfiguration) {
+      CrossThreadPersistentRegion::LockScope persistentLock(
+          ProcessHeap::crossThreadPersistentRegion());
       releaseStore(

[sof, 2017/02/09 06:36:24]

With the lock held, this could be a 'normal' store.

           reinterpret_cast<void* volatile*>(
               const_cast<typename std::remove_const<T>::type**>(&m_raw)),
           const_cast<typename std::remove_const<T>::type*>(ptr));
     } else {
       m_raw = ptr;
     }
     checkPointer();
     if (m_raw) {
       if (!m_persistentNode)
         initialize();
@@ skipping 629 matching lines @@
   static blink::CrossThreadPersistent<T> Unwrap(
       const blink::CrossThreadWeakPersistent<T>& wrapped) {
     blink::CrossThreadPersistentRegion::LockScope persistentLock(
         blink::ProcessHeap::crossThreadPersistentRegion());
     return blink::CrossThreadPersistent<T>(wrapped.get());
   }
 };
 }
 
 #endif  // Persistent_h