[heap] Synchronize registration of unprotected MemoryChunks.

Bug: chromium:831072
Change-Id: I17c7174d2910d329a4567a4e0b9b84f3e94802f9
Reviewed-on: https://chromium-review.googlesource.com/1004576Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52504}

src/heap/heap.cc

@@ -2235,9 +2235,11 @@ void Heap::ComputeFastPromotionMode(double survival_rate) {
 }
 
 void Heap::UnprotectAndRegisterMemoryChunk(MemoryChunk* chunk) {
-  if (unprotected_memory_chunks_registry_enabled_ &&
-      unprotected_memory_chunks_.insert(chunk).second) {
-    chunk->SetReadAndWritable();
+  if (unprotected_memory_chunks_registry_enabled_) {
+    base::LockGuard<base::Mutex> guard(&unprotected_memory_chunks_mutex_);
+    if (unprotected_memory_chunks_.insert(chunk).second) {
+      chunk->SetReadAndWritable();
+    }
   }
 }
 

src/heap/heap.h

@@ -2412,6 +2412,7 @@ class Heap {
 
   HeapObject* pending_layout_change_object_;
 
+  base::Mutex unprotected_memory_chunks_mutex_;
   std::unordered_set<MemoryChunk*> unprotected_memory_chunks_;
   bool unprotected_memory_chunks_registry_enabled_;