heap: Fix race during ephemeron tracing

Ephemeron tracing can occur during incremental marking steps if there
is no other work for it to do and the deadline was not reached. The
check whether a weak key is marked could race with a concurrent marker
marking it.

Bug: 986235
Change-Id: I5727a8800471dd24bb3f74430356c4dd7c12b130
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2156493Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#760485}

third_party/blink/renderer/platform/heap/marking_visitor.cc

@@ -109,7 +109,8 @@ void MarkingVisitorCommon::VisitBackingStoreWeakly(
 void MarkingVisitorCommon::VisitEphemeron(const void* key,
                                           const void* value,
                                           TraceCallback value_trace_callback) {
-  if (!HeapObjectHeader::FromPayload(key)->IsMarked())
+  if (!HeapObjectHeader::FromPayload(key)
+           ->IsMarked<HeapObjectHeader::AccessMode::kAtomic>())
     return;
   value_trace_callback(this, value);
 }