[heap] Allow concurrent insertion in slot set

Bug: chromium:738865
Change-Id: I4c8aa8c90ba401200222d95d6395c022fc023a71
Reviewed-on: https://chromium-review.googlesource.com/574535
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46715}

src/heap/slot-set.h

@@ -62,8 +62,15 @@ class SlotSet : public Malloced {
     Bucket bucket = LoadBucket<access_mode>(&buckets_[bucket_index]);
     if (bucket == nullptr) {
       bucket = AllocateBucket();
-      StoreBucket<access_mode>(&buckets_[bucket_index], bucket);
+      if (!SwapInNewBucket<access_mode>(&buckets_[bucket_index], bucket)) {
+        DeleteArray<uint32_t>(bucket);
+        bucket = LoadBucket<access_mode>(&buckets_[bucket_index]);
+      }
     }
+    // Check that monotonicity is preserved, i.e., once a bucket is set we do
+    // not free it concurrently.
+    DCHECK_NOT_NULL(bucket);
+    DCHECK_EQ(bucket, LoadBucket<access_mode>(&buckets_[bucket_index]));
     uint32_t mask = 1u << bit_index;
     if ((LoadCell<access_mode>(&bucket[cell_index]) & mask) == 0) {
       SetCellBits<access_mode>(&bucket[cell_index], mask);
@@ -287,6 +294,18 @@ class SlotSet : public Malloced {
     }
   }
 
+  template <AccessMode access_mode = AccessMode::ATOMIC>
+  bool SwapInNewBucket(Bucket* bucket, Bucket value) {
+    if (access_mode == AccessMode::ATOMIC) {
+      return base::AsAtomicWord::Release_CompareAndSwap(bucket, nullptr,
+                                                        value) == nullptr;
+    } else {
+      DCHECK_NULL(*bucket);
+      *bucket = value;
+      return true;
+    }
+  }
+
   template <AccessMode access_mode = AccessMode::ATOMIC>
   uint32_t LoadCell(uint32_t* cell) {
     if (access_mode == AccessMode::ATOMIC)