[heap] Fix merging typed slots on M1

Merging typed slots in the marking barrier may require allocating a
new typed slots set. We need a CodePageHeaderModificationScope since
that slot set is actually written into the code page.

Bug: chromium:1336850, v8:12797
Change-Id: If3f7d2bb179c2554ea2888c5ad92f098bd29b1c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3751210Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81590}

src/heap/marking-barrier.cc

@@ -159,6 +159,11 @@ void MarkingBarrier::PublishAll(Heap* heap) {
 void MarkingBarrier::Publish() {
   if (is_activated_) {
     worklist_.Publish();
+    base::Optional<CodePageHeaderModificationScope> optional_rwx_write_scope;
+    if (!typed_slots_map_.empty()) {
+      optional_rwx_write_scope.emplace(
+          "Merging typed slots may require allocating a new typed slot set.");
+    }
     for (auto& it : typed_slots_map_) {
       MemoryChunk* memory_chunk = it.first;
       // Access to TypeSlots need to be protected, since LocalHeaps might