runtime: wait to update arena_used until after mapping bitmap

This avoids a race with gcmarkwb_m that was leading to faults.

Fixes #10212.

Change-Id: I6fcf8d09f2692227063ce29152cb57366ea22487
Reviewed-on: https://go-review.googlesource.com/10816
Run-TryBot: Russ Cox <rsc@golang.org>
Reviewed-by: Austin Clements <austin@google.com>
diff --git a/src/runtime/malloc.go b/src/runtime/malloc.go
index 2d7e556..d182ed6 100644
--- a/src/runtime/malloc.go
+++ b/src/runtime/malloc.go
@@ -418,9 +418,9 @@
 		// Keep taking from our reservation.
 		p := h.arena_used
 		sysMap((unsafe.Pointer)(p), n, h.arena_reserved, &memstats.heap_sys)
-		h.arena_used += n
-		mHeap_MapBits(h)
-		mHeap_MapSpans(h)
+		mHeap_MapBits(h, p+n)
+		mHeap_MapSpans(h, p+n)
+		h.arena_used = p+n
 		if raceenabled {
 			racemapshadow((unsafe.Pointer)(p), n)
 		}
@@ -454,12 +454,12 @@
 	p_end := p + p_size
 	p += -p & (_PageSize - 1)
 	if uintptr(p)+n > uintptr(h.arena_used) {
-		h.arena_used = p + n
+		mHeap_MapBits(h, p+n)
+		mHeap_MapSpans(h, p+n)
+		h.arena_used = p+n
 		if p_end > h.arena_end {
 			h.arena_end = p_end
 		}
-		mHeap_MapBits(h)
-		mHeap_MapSpans(h)
 		if raceenabled {
 			racemapshadow((unsafe.Pointer)(p), n)
 		}