[heap] Do not touch pre-freed typed slot set memory anymore.

src/heap/slot-set.h

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_SLOT_SET_H
 #define V8_SLOT_SET_H
 
 #include <stack>
 
 #include "src/allocation.h"
@@ skipping 383 matching lines @@
           Address addr = page_start_ + type_and_offset.second;
           if (callback(type, host_addr, addr) == KEEP_SLOT) {
             new_count++;
             empty = false;
           } else {
             buffer[i].Clear();
           }
         }
       }
 
+      Chunk* next = chunk->next.Value();
       if (mode == PREFREE_EMPTY_CHUNKS && empty) {
         // We remove the chunk from the list but let it still point its next
         // chunk to allow concurrent iteration.
         if (previous) {
-          previous->next.SetValue(chunk->next.Value());
+          previous->next.SetValue(next);
         } else {
-          chunk_.SetValue(chunk->next.Value());
+          chunk_.SetValue(next);
         }
         base::LockGuard<base::Mutex> guard(&to_be_freed_chunks_mutex_);
         to_be_freed_chunks_.push(chunk);
       } else {
         previous = chunk;
       }
-      chunk = chunk->next.Value();
+      chunk = next;
     }
     return new_count;
   }
 
   void FreeToBeFreedChunks() {
     base::LockGuard<base::Mutex> guard(&to_be_freed_chunks_mutex_);
     while (!to_be_freed_chunks_.empty()) {
       Chunk* top = to_be_freed_chunks_.top();
       to_be_freed_chunks_.pop();
       delete top;
@@ skipping 39 matching lines @@
   Address page_start_;
   base::AtomicValue<Chunk*> chunk_;
   base::Mutex to_be_freed_chunks_mutex_;
   std::stack<Chunk*> to_be_freed_chunks_;
 };
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_SLOT_SET_H