cppgc: Fix bug in MarkingVerifier

Assigning to reference to std::unordered_set doesn't change the
reference. It merely replaces the content of rhs with that of lhs.
We should use pointers instead.

Bug: chromium:1056170
Change-Id: I496544ca4b16ce8ae8a9aff57cb05a07cad984c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2412184Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69918}

src/heap/cppgc/marking-verifier.cc

@@ -17,7 +17,7 @@ MarkingVerifier::MarkingVerifier(HeapBase& heap,
       ConservativeTracingVisitor(heap, *heap.page_backend(), *this) {
   Traverse(&heap.raw_heap());
   if (stack_state == Heap::Config::StackState::kMayContainHeapPointers) {
-    in_construction_objects_ = in_construction_objects_stack_;
+    in_construction_objects_ = &in_construction_objects_stack_;
     heap.stack()->IteratePointers(this);
     CHECK_EQ(in_construction_objects_stack_, in_construction_objects_heap_);
   }
@@ -45,7 +45,7 @@ void MarkingVerifier::VerifyChild(const void* base_object_payload) {
 void MarkingVerifier::VisitConservatively(
     HeapObjectHeader& header, TraceConservativelyCallback callback) {
   CHECK(header.IsMarked());
-  in_construction_objects_.insert(&header);
+  in_construction_objects_->insert(&header);
   callback(this, header);
 }
 

src/heap/cppgc/marking-verifier.h

@@ -39,8 +39,8 @@ class V8_EXPORT_PRIVATE MarkingVerifier final
 
   std::unordered_set<const HeapObjectHeader*> in_construction_objects_heap_;
   std::unordered_set<const HeapObjectHeader*> in_construction_objects_stack_;
-  std::unordered_set<const HeapObjectHeader*>& in_construction_objects_ =
-      in_construction_objects_heap_;
+  std::unordered_set<const HeapObjectHeader*>* in_construction_objects_ =
+      &in_construction_objects_heap_;
 };
 
 }  // namespace internal