[heap] Fix registering HashTable backings

The backing table should only be registered when processing the
HashTable as otherwise the backing might be black but its fields might
not be processed if it gets dropped till the final atomic pause.

The registration will still be early enough to announce the slot to
compaction.

Bug: chromium:875555
Change-Id: Iad97df11f79d95524839fd0377585bc68b2442ea
Reviewed-on: https://chromium-review.googlesource.com/1181130Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Keishi Hattori <keishi@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#584678}

third_party/blink/renderer/platform/wtf/hash_table.h

@@ -2067,6 +2067,9 @@ struct WeakProcessingHashTableHelper<kWeakHandling,
     if (!table->table_)
       return;
 
+    // Only trace the backing store. Its fields will be processed below.
+    Allocator::template TraceHashTableBackingOnly<ValueType, HashTableType>(
+        visitor, table->table_, &(table->table_));
     // Now perform weak processing (this is a no-op if the backing was
     // accessible through an iterator and was already marked strongly).
     for (ValueType* element = table->table_ + table->table_size_ - 1;
@@ -2127,12 +2130,6 @@ HashTable<Key, Value, Extractor, HashFunctions, Traits, KeyTraits, Allocator>::
     Allocator::template TraceHashTableBackingStrongly<ValueType, HashTable>(
         visitor, table_, &table_);
   } else {
-    // Only trace the backing store. The elements will be processed in the weak
-    // processing callback.
-    Allocator::template TraceHashTableBackingOnly<ValueType, HashTable>(
-        visitor, table_, &table_);
-    if (!table_)
-      return;
     // Weak HashTable. The HashTable may be held alive strongly from somewhere
     // else, e.g., an iterator.