The internalized string fixup during off-thread factory merging updates
object slot values, but didn't call the write barrier for that slot.

Now it does.

Bug: chromium:1011762
Change-Id: I11e546a06f48bdb476b66a1944f485b97b0d4dbe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2124318
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66936}