[turbofan] Release store context in new JSFunction

Bug: v8:12786
Change-Id: I0c53f9d7027c6b457186b2a04ab65daf7d6e0f85
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3698554Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81076}

src/heap/factory.cc

@@ -4032,7 +4032,7 @@ Handle<JSFunction> Factory::JSFunctionBuilder::BuildRaw(Handle<Code> code) {
   function.initialize_properties(isolate);
   function.initialize_elements();
   function.set_shared(*sfi_, mode);
-  function.set_context(*context_, mode);
+  function.set_context(*context_, kReleaseStore, mode);
   function.set_raw_feedback_cell(*feedback_cell, mode);
   function.set_code(*code, kReleaseStore, mode);
   if (function.has_prototype_slot()) {

src/objects/js-function-inl.h

@@ -71,6 +71,7 @@ int JSFunction::length() { return shared().length(); }
 
 ACCESSORS_RELAXED(JSFunction, code, CodeT, kCodeOffset)
 RELEASE_ACQUIRE_ACCESSORS(JSFunction, code, CodeT, kCodeOffset)
+RELEASE_ACQUIRE_ACCESSORS(JSFunction, context, Context, kContextOffset)
 
 #ifdef V8_EXTERNAL_CODE_SPACE
 void JSFunction::set_code(Code code, ReleaseStoreTag, WriteBarrierMode mode) {

src/objects/js-function.h

@@ -101,6 +101,9 @@ class JSFunction : public TorqueGeneratedJSFunction<
   inline Context context();
   DECL_RELAXED_GETTER(context, Context)
   inline bool has_context() const;
+  using TorqueGeneratedClass::context;
+  using TorqueGeneratedClass::set_context;
+  DECL_RELEASE_ACQUIRE_ACCESSORS(context, Context)
   inline JSGlobalProxy global_proxy();
   inline NativeContext native_context();
   inline int length();