[heap] Fix flushing of live bytes in concurrent marker.

Bug: chromium:694255
Change-Id: I8a3856d9b9c5d1ee701286dacf5c0c8ad400d91d
Reviewed-on: https://chromium-review.googlesource.com/626120
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47508}

src/heap/concurrent-marking.cc

@@ -474,7 +474,11 @@ void ConcurrentMarking::FlushLiveBytes(
   for (int i = 1; i <= kTasks; i++) {
     LiveBytesMap& live_bytes = task_state_[i].live_bytes;
     for (auto pair : live_bytes) {
-      marking_state->IncrementLiveBytes(pair.first, pair.second);
+      // ClearLiveness sets the live bytes to zero.
+      // Pages with zero live bytes might be already unmapped.
+      if (pair.second != 0) {
+        marking_state->IncrementLiveBytes(pair.first, pair.second);
+      }
     }
     live_bytes.clear();
   }