heap: Fix accounting when returning linear allocation area

Bug: 948807
Change-Id: I65133443b258ba4125d664df08383e3bf395abe8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1635524
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#664752}
diff --git a/third_party/blink/renderer/platform/heap/heap_page.cc b/third_party/blink/renderer/platform/heap/heap_page.cc
index 7c8e3289..5734032 100644
--- a/third_party/blink/renderer/platform/heap/heap_page.cc
+++ b/third_party/blink/renderer/platform/heap/heap_page.cc
@@ -805,7 +805,8 @@
   // Free and clear the old linear allocation area.
   if (HasCurrentAllocationArea()) {
     AddToFreeList(CurrentAllocationPoint(), RemainingAllocationSize());
-    SetRemainingAllocationSize(0);
+    GetThreadState()->Heap().DecreaseAllocatedObjectSize(
+        RemainingAllocationSize());
   }
   // Set up a new linear allocation area.
   current_allocation_point_ = point;
diff --git a/third_party/blink/renderer/platform/heap/heap_page.h b/third_party/blink/renderer/platform/heap/heap_page.h
index 44ad5116..59681b8 100644
--- a/third_party/blink/renderer/platform/heap/heap_page.h
+++ b/third_party/blink/renderer/platform/heap/heap_page.h
@@ -884,6 +884,8 @@
   }
   void SetAllocationPoint(Address, size_t);
 
+  // Only use when adjusting the area from allocation and free and not when
+  // returning it to free list.
   void SetRemainingAllocationSize(size_t);
 
   FreeList free_list_;