[compiler] Load FixedArray length atomically

... in FixedArrayBaseData's constructor. Also make get/TryGet check
if right-trimming happened (at the moment these methods are used such
that it can't happen yet).

Bug: v8:7790, v8:11956
Change-Id: I6bd23426b26bb7115c9d0f190eb4be04149368fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3018087
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75740}

src/compiler/heap-refs.cc

@@ -1476,7 +1476,7 @@ class FixedArrayBaseData : public HeapObjectData {
   FixedArrayBaseData(JSHeapBroker* broker, ObjectData** storage,
                      Handle<FixedArrayBase> object, ObjectDataKind kind)
       : HeapObjectData(broker, storage, object, kind),
-        length_(object->length()) {}
+        length_(object->length(kAcquireLoad)) {}
 
   int length() const { return length_; }
 
@@ -2749,7 +2749,15 @@ int ArrayBoilerplateDescriptionRef::constants_elements_length() const {
 ObjectRef FixedArrayRef::get(int i) const { return TryGet(i).value(); }
 
 base::Optional<ObjectRef> FixedArrayRef::TryGet(int i) const {
-  return TryMakeRef(broker(), object()->get(i, kRelaxedLoad));
+  DisallowGarbageCollection no_gc;
+  CHECK_GE(i, 0);
+  Object value = object()->get(i, kAcquireLoad);
+  if (i >= object()->length(kAcquireLoad)) {
+    // Right-trimming happened.
+    CHECK_LT(i, length());
+    return {};
+  }
+  return TryMakeRef(broker(), value);
 }
 
 Float64 FixedDoubleArrayRef::GetFromImmutableFixedDoubleArray(int i) const {