[heap] Fix data race in JSObject::RawFastDoublePropertyAsBitsAtPut with

concurrent marking.

The function should use relaxed store similar to other JSObject setters.

BUG=chromium:694255

Change-Id: I032f0763a5f2420d120bce976533aa0007868b97
Reviewed-on: https://chromium-review.googlesource.com/565573Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46535}

src/objects-inl.h

@@ -1569,7 +1569,11 @@ void JSObject::RawFastPropertyAtPut(FieldIndex index, Object* value) {
 
 void JSObject::RawFastDoublePropertyAsBitsAtPut(FieldIndex index,
                                                 uint64_t bits) {
-  WRITE_UINT64_FIELD(this, index.offset(), bits);
+  // Double unboxing is enabled only on 64-bit platforms.
+  DCHECK_EQ(kDoubleSize, kPointerSize);
+  Address field_addr = FIELD_ADDR(this, index.offset());
+  base::Relaxed_Store(reinterpret_cast<base::AtomicWord*>(field_addr),
+                      static_cast<base::AtomicWord>(bits));
 }
 
 void JSObject::FastPropertyAtPut(FieldIndex index, Object* value) {