[heap] Fix forwarding pointer race between sweeper threads and pointer updating threads.

src/heap/mark-compact.cc

Index: src/heap/mark-compact.cc
diff --git a/src/heap/mark-compact.cc b/src/heap/mark-compact.cc
index 78bafce3d6fc52d9c871eb2286df5e6970ed74f6..77aa603eb73f53c298863e45a65e4b7d5a0d759b 100644
--- a/src/heap/mark-compact.cc
+++ b/src/heap/mark-compact.cc
@@ -3640,6 +3640,11 @@ class PointerUpdateJobTraits {
       // There could still be stale pointers in large object space, map space,
       // and old space for pages that have been promoted.
       if (map_word.IsForwardingAddress()) {
+        // A sweeper thread may concurrently write a size value which looks like
+        // a forwarding pointer. We have to ignore these values.
+        if (map_word.ToRawValue() < Page::kPageSize) {
+          return REMOVE_SLOT;
+        }
         // Update the corresponding slot.
         *slot = map_word.ToForwardingAddress();
       }