[heap] Fix atomicity of IterateAndScavengePromotedObject

Bug: chromium:694255
TBR: mlippautz@chromium.org
No-Tree-Checks: true
No-Try: true
Change-Id: I720dcc79c4cb8c1cbd7dd6e6de4c6113c363b2f0
Reviewed-on: https://chromium-review.googlesource.com/610561
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47295}

src/heap/scavenger.cc

@@ -80,7 +80,7 @@ void Scavenger::IterateAndScavengePromotedObject(HeapObject* target, int size) {
   // it would be a violation of the invariant to record it's slots.
   const bool record_slots =
       is_compacting_ &&
-      heap()->mark_compact_collector()->marking_state()->IsBlack(target);
+      heap()->mark_compact_collector()->atomic_marking_state()->IsBlack(target);
   IterateAndScavengePromotedObjectsVisitor visitor(heap(), this, record_slots);
   if (target->IsJSFunction()) {
     // JSFunctions reachable through kNextFunctionLinkOffset are weak. Slots for