[heap] Fix data race in Sweeper::MakeIterable

The function can be invoked in a background task and has to take the
page mutex to sweep it.

Bug: chromium:1040700
Change-Id: I552fd636ca62f45496dc6c663a0a12d428eb2e20
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2007273Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65847}

src/heap/sweeper.cc

@@ -250,7 +250,8 @@ bool Sweeper::AreSweeperTasksRunning() { return num_sweeping_tasks_ != 0; }
 int Sweeper::RawSweep(
     Page* p, FreeListRebuildingMode free_list_mode,
     FreeSpaceTreatmentMode free_space_mode,
-    FreeSpaceMayContainInvalidatedSlots invalidated_slots_in_free_space) {
+    FreeSpaceMayContainInvalidatedSlots invalidated_slots_in_free_space,
+    const base::MutexGuard& page_guard) {
   Space* space = p->owner();
   DCHECK_NOT_NULL(space);
   DCHECK(free_list_mode == IGNORE_FREE_LIST || space->identity() == OLD_SPACE ||
@@ -461,7 +462,7 @@ int Sweeper::ParallelSweepPage(
     const FreeSpaceTreatmentMode free_space_mode =
         Heap::ShouldZapGarbage() ? ZAP_FREE_SPACE : IGNORE_FREE_SPACE;
     max_freed = RawSweep(page, REBUILD_FREE_LIST, free_space_mode,
-                         invalidated_slots_in_free_space);
+                         invalidated_slots_in_free_space, guard);
     DCHECK(page->SweepingDone());
   }
 
@@ -601,11 +602,12 @@ void Sweeper::AddPageForIterability(Page* page) {
 }
 
 void Sweeper::MakeIterable(Page* page) {
+  base::MutexGuard guard(page->mutex());
   DCHECK(IsValidIterabilitySpace(page->owner_identity()));
   const FreeSpaceTreatmentMode free_space_mode =
       Heap::ShouldZapGarbage() ? ZAP_FREE_SPACE : IGNORE_FREE_SPACE;
   RawSweep(page, IGNORE_FREE_LIST, free_space_mode,
-           FreeSpaceMayContainInvalidatedSlots::kNo);
+           FreeSpaceMayContainInvalidatedSlots::kNo, guard);
 }
 
 }  // namespace internal

src/heap/sweeper.h

@@ -93,7 +93,8 @@ class Sweeper {
   int RawSweep(
       Page* p, FreeListRebuildingMode free_list_mode,
       FreeSpaceTreatmentMode free_space_mode,
-      FreeSpaceMayContainInvalidatedSlots invalidated_slots_in_free_space);
+      FreeSpaceMayContainInvalidatedSlots invalidated_slots_in_free_space,
+      const base::MutexGuard& page_guard);
 
   // After calling this function sweeping is considered to be in progress
   // and the main thread can sweep lazily, but the background sweeper tasks