The CL in https://chromium-review.googlesource.com/c/chromium/src/+/1156112 re-introduced the bug that was fixed in  issue 828537 .

It's the old problem of "only marking a backing store" because processing its contents is delayed.

I guess nobody looked at the marking verifier.  I think we should make the marking verifier mandatory for platform/ changes to avoid running into such problems.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/57c4cd17156c4c0fe16c81e4e97d53bca265eb06

commit 57c4cd17156c4c0fe16c81e4e97d53bca265eb06
Author: Michael Lippautz <mlippautz@chromium.org>
Date: Tue Aug 21 07:36:51 2018

[heap] Fix registering HashTable backings

The backing table should only be registered when processing the
HashTable as otherwise the backing might be black but its fields might
not be processed if it gets dropped till the final atomic pause.

The registration will still be early enough to announce the slot to
compaction.

Bug:  chromium:875555 
Change-Id: Iad97df11f79d95524839fd0377585bc68b2442ea
Reviewed-on: https://chromium-review.googlesource.com/1181130
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Keishi Hattori <keishi@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#584678}
[modify] https://crrev.com/57c4cd17156c4c0fe16c81e4e97d53bca265eb06/third_party/blink/renderer/platform/wtf/hash_table.h