[heap] Avoid TransferColor in scavenger on shared objects

We must not use TransferColor on objects promoted into shared objects
when performing a scavenger during incremental marking.

Bug: v8:12628, v8:11708
Change-Id: I5833c0da8aa3dcd03287d3803a68189e85875bc1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3463714Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79089}

src/heap/scavenger-inl.h

@@ -83,7 +83,8 @@ void Scavenger::PageMemoryFence(MaybeObject object) {
 }
 
 bool Scavenger::MigrateObject(Map map, HeapObject source, HeapObject target,
-                              int size) {
+                              int size,
+                              PromotionHeapChoice promotion_heap_choice) {
   // Copy the content of source to target.
   target.set_map_word(MapWord::FromMap(map), kRelaxedStore);
   heap()->CopyBlock(target.address() + kTaggedSize,
@@ -100,7 +101,8 @@ bool Scavenger::MigrateObject(Map map, HeapObject source, HeapObject target,
     heap()->OnMoveEvent(target, source, size);
   }
 
-  if (is_incremental_marking_) {
+  if (is_incremental_marking_ &&
+      promotion_heap_choice != kPromoteIntoSharedHeap) {
     heap()->incremental_marking()->TransferColor(source, target);
   }
   heap()->UpdateAllocationSite(map, source, &local_pretenuring_feedback_);
@@ -123,7 +125,8 @@ CopyAndForwardResult Scavenger::SemiSpaceCopyObject(
   if (allocation.To(&target)) {
     DCHECK(heap()->incremental_marking()->non_atomic_marking_state()->IsWhite(
         target));
-    const bool self_success = MigrateObject(map, object, target, object_size);
+    const bool self_success =
+        MigrateObject(map, object, target, object_size, kPromoteIntoLocalHeap);
     if (!self_success) {
       allocator_.FreeLast(NEW_SPACE, target, object_size);
       MapWord map_word = object.map_word(kAcquireLoad);
@@ -171,7 +174,8 @@ CopyAndForwardResult Scavenger::PromoteObject(Map map, THeapObjectSlot slot,
   if (allocation.To(&target)) {
     DCHECK(heap()->incremental_marking()->non_atomic_marking_state()->IsWhite(
         target));
-    const bool self_success = MigrateObject(map, object, target, object_size);
+    const bool self_success =
+        MigrateObject(map, object, target, object_size, promotion_heap_choice);
     if (!self_success) {
       allocator_.FreeLast(OLD_SPACE, target, object_size);
       MapWord map_word = object.map_word(kAcquireLoad);

src/heap/scavenger.h

@@ -111,6 +111,8 @@ class Scavenger {
   size_t bytes_promoted() const { return promoted_size_; }
 
  private:
+  enum PromotionHeapChoice { kPromoteIntoLocalHeap, kPromoteIntoSharedHeap };
+
   // Number of objects to process before interrupting for potentially waking
   // up other tasks.
   static const int kInterruptThreshold = 128;
@@ -135,7 +137,8 @@ class Scavenger {
 
   // Copies |source| to |target| and sets the forwarding pointer in |source|.
   V8_INLINE bool MigrateObject(Map map, HeapObject source, HeapObject target,
-                               int size);
+                               int size,
+                               PromotionHeapChoice promotion_heap_choice);
 
   V8_INLINE SlotCallbackResult
   RememberedSetEntryNeeded(CopyAndForwardResult result);
@@ -145,8 +148,6 @@ class Scavenger {
   SemiSpaceCopyObject(Map map, THeapObjectSlot slot, HeapObject object,
                       int object_size, ObjectFields object_fields);
 
-  enum PromotionHeapChoice { kPromoteIntoLocalHeap, kPromoteIntoSharedHeap };
-
   template <typename THeapObjectSlot,
             PromotionHeapChoice promotion_heap_choice = kPromoteIntoLocalHeap>
   V8_INLINE CopyAndForwardResult PromoteObject(Map map, THeapObjectSlot slot,