Code:  void GCInfoTable::EnsureGCInfoIndex(const GCInfo* gc_info,
                                     size_t* gc_info_index_slot) {
   DCHECK(gc_info);
   DCHECK(gc_info_index_slot);
  DEFINE_THREAD_SAFE_STATIC_LOCAL(Mutex, mutex, ());
  MutexLocker locker(mutex);
 
   if (*gc_info_index_slot)
     return;
 
  int index = ++gc_info_index_;
   size_t gc_info_index = static_cast<size_t>(index);
   CHECK(gc_info_index < GCInfoTable::kMaxIndex);
  if (gc_info_index >= gc_info_table_size_)
     Resize();
 
  g_gc_info_table[gc_info_index] = gc_info;
   ReleaseStore(reinterpret_cast<int*>(gc_info_index_slot), index);
 }

Vulnerability Type: 
CWE ID: CWE-362
Summary: A race condition in Oilpan in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Commit Message: [oilpan] Fix GCInfoTable for multiple threads

Previously, grow and access from different threads could lead to a race
on the table backing; see bug.

- Rework the table to work on an existing reservation.
- Commit upon growing, avoiding any copies.

Drive-by: Fix over-allocation of table.

Bug: chromium:841280
Change-Id: I329cb6f40091e14e8c05334ba1104a9440c31d43
Reviewed-on: https://chromium-review.googlesource.com/1061525
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#560434}