[offthread] Fix a data race in Page::Expand

This is a quick fix that guards the NotifyOldGenerationExpansion call,
which is not thread-safe outside GC.

Bug: v8:10536
Change-Id: Iff42fee24242c2e88e0c814ae41766e97181324a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2204037Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67821}

src/heap/paged-spaces.cc

@@ -204,6 +204,7 @@ void PagedSpace::MergeLocalSpace(LocalSpace* other) {
     AddPage(p);
     // These code pages were allocated by the CompactionSpace.
     if (identity() == CODE_SPACE) heap()->isolate()->AddCodeMemoryChunk(p);
+    heap()->NotifyOldGenerationExpansion();
     DCHECK_IMPLIES(
         !p->IsFlagSet(Page::NEVER_ALLOCATE_ON_PAGE),
         p->AvailableInFreeList() == p->AvailableInFreeListFromAllocatedBytes());
@@ -338,7 +339,9 @@ bool PagedSpace::Expand() {
   }
   Free(page->area_start(), page->area_size(),
        SpaceAccountingMode::kSpaceAccounted);
-  heap()->NotifyOldGenerationExpansion();
+  if (!is_off_thread_space()) {
+    heap()->NotifyOldGenerationExpansion();
+  }
   return true;
 }