[oilpan] Destroy linear allocation area before marking

Bug: chromium:757440
Change-Id: I7ae80b85a64245346d9b7a41aea351b80c86b4b9
Reviewed-on: https://chromium-review.googlesource.com/941221Reviewed-by: Keishi Hattori <keishi@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#539833}

third_party/WebKit/Source/platform/heap/HeapPage.cpp

@@ -438,6 +438,13 @@ NormalPageArena::NormalPageArena(ThreadState* state, int index)
   ClearFreeLists();
 }
 
+void NormalPageArena::MakeConsistentForGC() {
+  BaseArena::MakeConsistentForGC();
+
+  // Remove linear allocation area.
+  SetAllocationPoint(nullptr, 0);
+}
+
 void NormalPageArena::ClearFreeLists() {
   SetAllocationPoint(nullptr, 0);
   free_list_.Clear();

third_party/WebKit/Source/platform/heap/HeapPage.h

@@ -779,7 +779,7 @@ class PLATFORM_EXPORT BaseArena {
 #endif
   virtual void TakeFreelistSnapshot(const String& dump_base_name) {}
   virtual void ClearFreeLists() {}
-  void MakeConsistentForGC();
+  virtual void MakeConsistentForGC();
   void MakeConsistentForMutator();
 #if DCHECK_IS_ON()
   virtual bool IsConsistentForGC() = 0;
@@ -877,6 +877,8 @@ class PLATFORM_EXPORT NormalPageArena final : public BaseArena {
            (address < (CurrentAllocationPoint() + RemainingAllocationSize()));
   }
 
+  void MakeConsistentForGC() override;
+
  private:
   void AllocatePage();