[heap] Scavenger: Fix benign race with forwarding pointer load

NOTRY=true

Bug: chromium:738865
Change-Id: I8e3ac86bf6f0b3356398053b157ec03217e78a08
Reviewed-on: https://chromium-review.googlesource.com/589129Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46928}

src/heap/scavenger-inl.h

@@ -230,8 +230,8 @@ void Scavenger::EvacuateObject(HeapObject** slot, Map* map,
 void Scavenger::ScavengeObject(HeapObject** p, HeapObject* object) {
   DCHECK(heap()->InFromSpace(object));
 
-  // Relaxed load here. We either load a forwarding pointer or the map.
-  MapWord first_word = object->map_word();
+  // Synchronized load that consumes the publishing CAS of MigrateObject.
+  MapWord first_word = object->synchronized_map_word();
 
   // If the first word is a forwarding address, the object has already been
   // copied.