[compiler] TSAN warning in PropertyArray::get()

PropertyArray::get() and a few other functions there call
PropertyArray::length() in an assert. These need to be the acquire
load version of length() to keep TSAN happy.

Bug: chromium:1225277
Change-Id: Ic43bfc1902dea3e87f353be0efd03563c13c1e10
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2997105Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75489}

src/objects/property-array-inl.h

@@ -32,7 +32,7 @@ Object PropertyArray::get(int index) const {
 
 Object PropertyArray::get(PtrComprCageBase cage_base, int index) const {
   DCHECK_LT(static_cast<unsigned>(index),
-            static_cast<unsigned>(this->length()));
+            static_cast<unsigned>(this->length(kAcquireLoad)));
   return TaggedField<Object>::Relaxed_Load(cage_base, *this,
                                            OffsetOfElementAt(index));
 }
@@ -40,7 +40,7 @@ Object PropertyArray::get(PtrComprCageBase cage_base, int index) const {
 void PropertyArray::set(int index, Object value) {
   DCHECK(IsPropertyArray());
   DCHECK_LT(static_cast<unsigned>(index),
-            static_cast<unsigned>(this->length()));
+            static_cast<unsigned>(this->length(kAcquireLoad)));
   int offset = OffsetOfElementAt(index);
   RELAXED_WRITE_FIELD(*this, offset, value);
   WRITE_BARRIER(*this, offset, value);
@@ -48,7 +48,7 @@ void PropertyArray::set(int index, Object value) {
 
 void PropertyArray::set(int index, Object value, WriteBarrierMode mode) {
   DCHECK_LT(static_cast<unsigned>(index),
-            static_cast<unsigned>(this->length()));
+            static_cast<unsigned>(this->length(kAcquireLoad)));
   int offset = OffsetOfElementAt(index);
   RELAXED_WRITE_FIELD(*this, offset, value);
   CONDITIONAL_WRITE_BARRIER(*this, offset, value, mode);