heap: Use atomic version of swap.

Bug: 986235
Change-Id: Ide481dbd27b7a0531b8fe003c80d15126a405bf5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2105334
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#751209}

third_party/blink/renderer/platform/wtf/allocator/allocator.h

@@ -341,6 +341,14 @@ ALWAYS_INLINE void AtomicMemzero<3 * sizeof(size_t)>(void* buf) {
       ->store(0, std::memory_order_relaxed);
 }
 
+// Swaps values using atomic writes.
+template <typename T>
+ALWAYS_INLINE void AtomicWriteSwap(T& lhs, T& rhs) {
+  T tmp_val = rhs;
+  AsAtomicPtr(&rhs)->store(lhs, std::memory_order_relaxed);
+  AsAtomicPtr(&lhs)->store(tmp_val, std::memory_order_relaxed);
+}
+
 }  // namespace WTF
 
 // This version of placement new omits a 0 check.

third_party/blink/renderer/platform/wtf/hash_table.h

@@ -2012,9 +2012,7 @@ void HashTable<Key,
   // race). Atomic reads are not needed here because this method is only called
   // on the mutator thread, which is also the only one that writes to them, so
   // there is *no* risk of data races when reading.
-  Value* tmp_table = other.table_;
-  AsAtomicPtr(&other.table_)->store(table_, std::memory_order_relaxed);
-  AsAtomicPtr(&table_)->store(tmp_table, std::memory_order_relaxed);
+  AtomicWriteSwap(table_, other.table_);
   Allocator::template BackingWriteBarrierForHashTable<HashTable>(&table_);
   Allocator::template BackingWriteBarrierForHashTable<HashTable>(&other.table_);
   if (IsWeak<ValueType>::value) {

third_party/blink/renderer/platform/wtf/vector.h

@@ -583,7 +583,7 @@ class VectorBuffer<T, 0, Allocator> : protected VectorBufferBase<T, Allocator> {
                         OffsetRange other_hole) {
     static_assert(VectorTraits<T>::kCanSwapUsingCopyOrMove,
                   "Cannot swap using copy or move.");
-    std::swap(buffer_, other.buffer_);
+    AtomicWriteSwap(buffer_, other.buffer_);
     std::swap(capacity_, other.capacity_);
     std::swap(size_, other.size_);
     Allocator::BackingWriteBarrier(&buffer_);