Revert "[heap] Do not revive WeakMember during incremental marking"

This reverts commit 1638e067.

Reason for revert: New tests are flaky and causing problems when submitting code.

Original change's description:
> [heap] Do not revive WeakMember during incremental marking
> 
> Overwriting deleted values with cleared values potentially revives
> buckets in collections. For atomic garbage collections this is not a
> problem as those values are filered out in the visitors already. For
> incremental garbage collections the deleted values may be introduced by
> erasing a value from a container after it has been visited by the
> incremental marker.
> 
> Bug: chromium:870196, chromium:757440
> Change-Id: I1d628f00c2e2ea6e36e880d50a397dcbcc8566d1
> Reviewed-on: https://chromium-review.googlesource.com/1164950
> Reviewed-by: Kentaro Hara <haraken@chromium.org>
> Reviewed-by: Keishi Hattori <keishi@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#581238}

TBR=haraken@chromium.org,keishi@chromium.org,mlippautz@chromium.org

Change-Id: I632b5594d137acd37b4639ebcd46f8d61638dbc0
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:870196, chromium:757440
Reviewed-on: https://chromium-review.googlesource.com/1165328Reviewed-by: Fredrik Hubinette <hubbe@chromium.org>
Commit-Queue: Fredrik Hubinette <hubbe@chromium.org>
Cr-Commit-Position: refs/heads/master@{#581277}

third_party/blink/renderer/platform/heap/heap.h

@@ -679,17 +679,11 @@ Address ThreadHeap::Reallocate(void* previous, size_t size) {
 template <typename T>
 void Visitor::HandleWeakCell(Visitor* self, void* object) {
   T** cell = reinterpret_cast<T**>(object);
-  T* contents = *cell;
-  if (contents) {
-    if (contents == reinterpret_cast<T*>(-1)) {
-      // '-1' means deleted value. This can happen when weak fields are deleted
-      // while incremental marking is running. Deleted values need to be
-      // preserved to avoid reviving objects in containers.
-      return;
-    }
-    if (!ObjectAliveTrait<T>::IsHeapObjectAlive(contents))
-      *cell = nullptr;
-  }
+  // '-1' means deleted value. This can happen when weak fields are deleted
+  // while incremental marking is running.
+  if (*cell && (*cell == reinterpret_cast<T*>(-1) ||
+                !ObjectAliveTrait<T>::IsHeapObjectAlive(*cell)))
+    *cell = nullptr;
 }
 
 }  // namespace blink

third_party/blink/renderer/platform/heap/incremental_marking_test.cc

@@ -1645,7 +1645,7 @@ TEST(IncrementalMarkingTest, TestDriver) {
 }
 
 TEST(IncrementalMarkingTest, DropBackingStore) {
-  // Regression test: https://crbug.com/828537
+  // Regression test: crbug.com/828537
   using WeakStore = HeapHashCountedSet<WeakMember<Object>>;
 
   Persistent<WeakStore> persistent(new WeakStore);
@@ -1659,40 +1659,6 @@ TEST(IncrementalMarkingTest, DropBackingStore) {
   driver.FinishGC();
 }
 
-TEST(IncrementalMarkingTest, WeakCallbackDoesNotReviveDeletedValue) {
-  // Regression test: https://crbug.com/870196
-
-  // std::pair avoids treating the hashset backing as weak backing.
-  using WeakStore = HeapHashCountedSet<std::pair<WeakMember<Object>, size_t>>;
-
-  Persistent<WeakStore> persistent(new WeakStore);
-  // Create at least two entries to avoid completely emptying out the data
-  // structure.
-  persistent->insert({Object::Create(), 0});
-  persistent->insert({Object::Create(), 1});
-  IncrementalMarkingTestDriver driver(ThreadState::Current());
-  driver.Start();
-  // The backing is not treated as weak backing and thus eagerly processed,
-  // effectively registering the slots of WeakMembers.
-  driver.FinishSteps();
-  // The following deletes the first found entry. The second entry is left
-  // untouched.
-  for (auto& entries : *persistent) {
-    persistent->erase(entries.key);
-    break;
-  }
-  driver.FinishGC();
-
-  size_t count = 1;
-  for (const auto& entry : *persistent) {
-    count++;
-    // Use the entry to keep compilers happy.
-    if (entry.key.second > 0) {
-    }
-  }
-  CHECK_EQ(1u, count);
-}
-
 }  // namespace incremental_marking_test
 }  // namespace blink