Code:  void GCInfoTable::Resize() {
  static const int kGcInfoZapValue = 0x33;
  const size_t kInitialSize = 512;
  size_t new_size =
      gc_info_table_size_ ? 2 * gc_info_table_size_ : kInitialSize;
  DCHECK(new_size < GCInfoTable::kMaxIndex);
  g_gc_info_table =
      reinterpret_cast<GCInfo const**>(WTF::Partitions::FastRealloc(
          g_gc_info_table, new_size * sizeof(GCInfo), "GCInfo"));
  DCHECK(g_gc_info_table);
  memset(reinterpret_cast<uint8_t*>(g_gc_info_table) +
             gc_info_table_size_ * sizeof(GCInfo),
         kGcInfoZapValue, (new_size - gc_info_table_size_) * sizeof(GCInfo));
  gc_info_table_size_ = new_size;
 }

Vulnerability Type: 
CWE ID: CWE-362
Summary: A race condition in Oilpan in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Commit Message: [oilpan] Fix GCInfoTable for multiple threads

Previously, grow and access from different threads could lead to a race
on the table backing; see bug.

- Rework the table to work on an existing reservation.
- Commit upon growing, avoiding any copies.

Drive-by: Fix over-allocation of table.

Bug: chromium:841280
Change-Id: I329cb6f40091e14e8c05334ba1104a9440c31d43
Reviewed-on: https://chromium-review.googlesource.com/1061525
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#560434}