[heap] Perform filler check based on map instead of instance type in LiveObjectIterator.

src/heap/mark-compact-inl.h

Index: src/heap/mark-compact-inl.h
diff --git a/src/heap/mark-compact-inl.h b/src/heap/mark-compact-inl.h
index ea7e2a4a543e8f3f3ebe7111aefa047c64a139fd..9fe262d426b1a6bad880c4c86dac51955eb7d909 100644
--- a/src/heap/mark-compact-inl.h
+++ b/src/heap/mark-compact-inl.h
@@ -122,6 +122,9 @@ void CodeFlusher::ClearNextCandidate(SharedFunctionInfo* candidate) {
 
 template <LiveObjectIterationMode T>
 HeapObject* LiveObjectIterator<T>::Next() {
+  Map* one_word_filler = heap()->one_pointer_filler_map();
+  Map* two_word_filler = heap()->two_pointer_filler_map();
+  Map* free_space_map = heap()->free_space_map();
   while (!it_.Done()) {
     HeapObject* object = nullptr;
     while (current_cell_ != 0) {
@@ -193,7 +196,11 @@ HeapObject* LiveObjectIterator<T>::Next() {
 
       // We found a live object.
       if (object != nullptr) {
-        if (object->IsFiller()) {
+        // Do not use IsFiller() here. This may cause a data race for reading
+        // out the instance type when a new map concurrently is written into
+        // this object while iterating over the object.
+        if (map == one_word_filler || map == two_word_filler ||
+            map == free_space_map) {
           // There are two reasons why we can get black or grey fillers:
           // 1) Black areas together with slack tracking may result in black one
           // word filler objects.