Please assign to the right owner.

It does repro 1 out of 50 runs locally, so I will only look into the stack trace. It looks like what happens is.
M: main thread
S: sweeper thread

1) M starts sweeper threads and continues JS execution
2) M triggers a scavenge which scavenges an object from slot s (it updates s after that non-atomically)
3) S sweeps page of slot s. s is in a free space and therefore gets overwritten (currently non-atomically) => data race

v8/src/heap/scavenger.cc:189 - the update of the scavenged slot would need to be changed to CAS.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/fdff4b072ee15f8dbca60e86fdd4d054f034cb7f

commit fdff4b072ee15f8dbca60e86fdd4d054f034cb7f
Author: hpayer <hpayer@chromium.org>
Date: Wed Jan 11 13:32:13 2017

[heap] Use CAS to update old to new slots in Scavenger.

BUG= chromium:676635 

Review-Url: https://codereview.chromium.org/2628853002
Cr-Commit-Position: refs/heads/master@{#42227}

[modify] https://crrev.com/fdff4b072ee15f8dbca60e86fdd4d054f034cb7f/src/heap/scavenger.cc

ClusterFuzz has detected this issue as fixed in range 441524:441984.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4717344103596032

Fuzzer: ochang_domfuzzer
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race ATOMIC WRITE 8
Crash Address: 0x7f1bc943c500
Crash State:
  v8::internal::Heap::CreateFillerObjectAt
  v8::internal::FreeList::Free
  v8::internal::MarkCompactCollector::Sweeper::RawSweep
  
Sanitizer: thread (TSAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_tsan_chrome_mp&range=440074:440099
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_tsan_chrome_mp&range=441524:441984

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97STrFG7sonreS2YhvFR30y3u9ZFOHhkjFjit0TY50qIb_NXzv5y1NR8aXOy9T94clk-ev7b-0-d4AUd4m1ziufSGTZosfJK9FjSDVq--Sxz4ABnIY7Pc1N1btMsbG_yXs6r2HyPImjUUkdbGVKLyF-qE_IoFj5iiVYhMUDxxTlw7ZK35k?testcase_id=4717344103596032


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4717344103596032 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Your change meets the bar and is auto-approved for M56. Please go ahead and merge the CL manually. Please contact milestone owner if you have questions.
Owners: amineer@(clank), cmasso@(bling), gkihumba@(cros), bustamante@(desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Your change has been approved for M56. Please ensure to verify the fix and if all looks good, merge ASAP.

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/dd44aa6d859fd3e1af12c6add0e4ac6194a2709a

commit dd44aa6d859fd3e1af12c6add0e4ac6194a2709a
Author: Hannes Payer <hpayer@chromium.org>
Date: Wed Jan 18 15:46:44 2017

Merged: [heap] Use CAS to update old to new slots in Scavenger.

Revision: fdff4b072ee15f8dbca60e86fdd4d054f034cb7f

BUG= chromium:676635 
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=mlippautz@chromium.org

Review-Url: https://codereview.chromium.org/2639303002 .
Cr-Commit-Position: refs/branch-heads/5.6@{#79}
Cr-Branched-From: bdd3886218dfe76e8560eb8a18401942452ae859-refs/heads/5.6.326@{#1}
Cr-Branched-From: 879f6599eee6e1dfcbe9a24bf688b261c03e9558-refs/heads/master@{#41014}

[modify] https://crrev.com/dd44aa6d859fd3e1af12c6add0e4ac6194a2709a/src/heap/scavenger.cc

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot