The data race is in Blink code, not in V8 code.

Elliott: Would you take a look?

It looks like this is a data race caused by https://chromium.googlesource.com/chromium/src/+/3b4b07ced6315a25960ca5a51dd1b7ba88de53db

I reverted that patch.

ClusterFuzz has detected this issue as fixed in range 458081:458090.

Detailed report: https://clusterfuzz.com/testcase?key=5724177782013952

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race WRITE 4
Crash Address: 0x7f842ab45a08
Crash State:
  blink::V8GCController::gcEpilogue
  v8::internal::Heap::CallGCEpilogueCallbacks
  v8::internal::Heap::PerformGarbageCollection
  
Sanitizer: thread (TSAN)

Fixed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=458081:458090

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv95gdTBj4lfRkXs3NGVGoV6GX-p_eKTipE9yWHKq3T831o2d0_wEb6Cdg57VMJgYjIBajyrI07pTJx_K_lpQ3xi0q2T5PpADYPdsVlFsNd2CowZdW4areqt7Lv5I6f8LpbskOzxOqniNlmcEI-5SrO8mmk3BMv6wyLSPNUVNoRGgw0mTz13XVfyAOJpqghrYic4fB_7g7i3mxD5ZcDhMt1s5V8_ZxZSsb_e9VRZu4xWE2-2c6Cx2B2IFsxHVHQiNaT7LwZlE9Ayj2tjOg28y3kthaOKgHX2DaNp3KFyM_gqCO7HuWUM-xcIl486MTHw5XJ8bzh8IgwyCgh-LAJ4GTlYhT0v0UpdHn_NWrREsrWUIv2l0EFyf8VsJCuSb3uNXvgFNAUyMdfEGp93jyQ27BDwDOxs-6A?testcase_id=5724177782013952


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.