heap: Don't create a new Member in TraceMayBeDeleted(WeakMember)

The static_cast from WeakMember to Member actually constructs a Member.
If this happens on a concurrent thread, it will fail during Member
creation in SaveCreationThreadState (creation_thread_state_ is nullptr).

Bug: 986235
Change-Id: I5d2edf3b714313a9d23663fb805f3bf8486e8f4e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2061248
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#742139}

third_party/blink/renderer/platform/heap/trace_traits.h

@@ -379,7 +379,7 @@ struct TraceInCollectionTrait<kWeakHandling, blink::Member<T>, Traits> {
 template <typename T, typename Traits>
 struct TraceInCollectionTrait<kNoWeakHandling, blink::WeakMember<T>, Traits> {
   static bool Trace(blink::Visitor* visitor, blink::WeakMember<T>& t) {
-    visitor->TraceMaybeDeleted(static_cast<blink::Member<T>>(t));
+    visitor->TraceMaybeDeleted(t);
     return false;
   }
 };

third_party/blink/renderer/platform/heap/visitor.h

@@ -108,12 +108,10 @@ class PLATFORM_EXPORT Visitor {
     VisitRoot(const_cast<T*>(t), TraceDescriptorFor(t), location);
   }
 
-  template <typename T, bool maybe_deleted = false>
+  template <typename T>
   void Trace(const Member<T>& t) {
     T* value = t.GetSafe();
 
-    if (maybe_deleted && Member<T>::IsMemberHashTableDeletedValue(value))
-      return;
     DCHECK(!Member<T>::IsMemberHashTableDeletedValue(value));
 
     Trace(value);
@@ -121,7 +119,23 @@ class PLATFORM_EXPORT Visitor {
 
   template <typename T>
   ALWAYS_INLINE void TraceMaybeDeleted(const Member<T>& t) {
-    Trace<T, true>(t);
+    T* value = t.GetSafe();
+
+    if (Member<T>::IsMemberHashTableDeletedValue(value))
+      return;
+
+    Trace<T>(value);
+  }
+
+  // TraceMayBeDeleted strongifies WeakMembers.
+  template <typename T>
+  ALWAYS_INLINE void TraceMaybeDeleted(const WeakMember<T>& t) {
+    T* value = t.GetSafe();
+
+    if (WeakMember<T>::IsMemberHashTableDeletedValue(value))
+      return;
+
+    Trace<T>(value);
   }
 
   // Fallback methods used only when we need to trace raw pointers of T. This is