heap: Resolve data race when adding to LinkedHashSet

Bug: 986235
Change-Id: I0880c784e61d5978ebc8c3a7de57c04b1a8a08c4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1984309Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#727969}

third_party/blink/renderer/platform/wtf/linked_hash_set.h

@@ -316,9 +316,10 @@ class LinkedHashSet {
     impl_.Trace(visitor);
     // Should the underlying table be moved by GC, register a callback
     // that fixes up the interior pointers that the (Heap)LinkedHashSet keeps.
-    if (impl_.table_) {
+    auto* table = AsAtomicPtr(&impl_.table_)->load(std::memory_order_relaxed);
+    if (table) {
       Allocator::RegisterBackingStoreCallback(
-          visitor, impl_.table_,
+          visitor, table,
           NodeHashTraits::template MoveBackingCallback<ImplType>);
     }
   }