cppgc: Add missing page sync to TraceTrait of mixins

Every page that can be accessed concurrently during marking needs to be
synced to avoid data races with page alloation. TraceTrait for mixins
uses the object start bitmap of a page and thus requires a sync.

Bug: chromium:10561670
Change-Id: Ia26be973019dcd1d9f7650cc139b16369d515df6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783023Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73623}

src/heap/cppgc/trace-trait.cc

@@ -14,9 +14,10 @@ TraceDescriptor TraceTraitFromInnerAddressImpl::GetTraceDescriptor(
     const void* address) {
   // address is guaranteed to be on a normal page because this is used only for
   // mixins.
+  const BasePage* page = BasePage::FromPayload(address);
+  page->SynchronizedLoad();
   const HeapObjectHeader& header =
-      BasePage::FromPayload(address)
-          ->ObjectHeaderFromInnerAddress<AccessMode::kAtomic>(address);
+      page->ObjectHeaderFromInnerAddress<AccessMode::kAtomic>(address);
   return {header.Payload(), GlobalGCInfoTable::GCInfoFromIndex(
                                 header.GetGCInfoIndex<AccessMode::kAtomic>())
                                 .trace};