[heap] Use TryMark in WriteBarrier

With concurrent marking and without TryMark, the same object can be
marked and pushed to the worklist more than once (i.e. by both mutator
and visitors), meaning the object will be traced multiple times.

Bug: 986235
Change-Id: I6d0d8a9da79da9d459b137082f91c9125fafd8e8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1731838
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#684286}

third_party/blink/renderer/platform/heap/heap_page.h

@@ -1212,7 +1212,8 @@ NO_SANITIZE_ADDRESS inline bool HeapObjectHeader::TryMark() {
   }
   internal::AsanUnpoisonScope unpoison_scope(
       static_cast<const void*>(&encoded_low_), sizeof(encoded_low_));
-  auto* atomic_encoded = reinterpret_cast<std::atomic<uint16_t>*>(encoded_low_);
+  auto* atomic_encoded =
+      reinterpret_cast<std::atomic<uint16_t>*>(&encoded_low_);
   uint16_t old_value = atomic_encoded->load(std::memory_order_relaxed);
   if (old_value & kHeaderMarkBitMask)
     return false;

third_party/blink/renderer/platform/heap/marking_visitor.cc

@@ -106,7 +106,8 @@ void MarkingVisitor::WriteBarrierSlow(void* value) {
   }
 
   // Mark and push trace callback.
-  header->Mark();
+  if (!header->TryMark<HeapObjectHeader::AccessMode::kAtomic>())
+    return;
   MarkingVisitor* visitor = thread_state->CurrentVisitor();
   visitor->AccountMarkedBytes(header);
   visitor->marking_worklist_.Push(