[heap] Change page owner when merging off-thread LO space

Fixed: v8:10129
Bug: chromium:1011762
Change-Id: I2b2398178a56c5378c95fccac57040a6eddda560
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2004609
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65813}

src/heap/spaces.cc

@@ -4175,10 +4175,9 @@ void OldLargeObjectSpace::PromoteNewLargeObject(LargePage* page) {
   DCHECK(!page->IsFlagSet(MemoryChunk::TO_PAGE));
   size_t object_size = static_cast<size_t>(page->GetObject().Size());
   static_cast<LargeObjectSpace*>(page->owner())->RemovePage(page, object_size);
-  AddPage(page, object_size);
   page->ClearFlag(MemoryChunk::FROM_PAGE);
   page->SetOldGenerationPageFlags(heap()->incremental_marking()->IsMarking());
-  page->set_owner(this);
+  AddPage(page, object_size);
 }
 
 void LargeObjectSpace::AddPage(LargePage* page, size_t object_size) {
@@ -4187,6 +4186,7 @@ void LargeObjectSpace::AddPage(LargePage* page, size_t object_size) {
   objects_size_ += object_size;
   page_count_++;
   memory_chunk_list_.PushBack(page);
+  page->set_owner(this);
 }
 
 void LargeObjectSpace::RemovePage(LargePage* page, size_t object_size) {
@@ -4195,6 +4195,7 @@ void LargeObjectSpace::RemovePage(LargePage* page, size_t object_size) {
   objects_size_ -= object_size;
   page_count_--;
   memory_chunk_list_.Remove(page);
+  page->set_owner(nullptr);
 }
 
 void LargeObjectSpace::FreeUnmarkedObjects() {

test/unittests/unittests.status

@@ -39,11 +39,6 @@
   # https://crbug.com/v8/9380
   # The test is broken and needs to be fixed to use separate isolates.
   'BackingStoreTest.RacyGrowWasmMemoryInPlace': [SKIP],
-
-  # https://crbug.com/v8/10129
-  # This functionality is only used in tests so far, so unblocking TSAN while
-  # its bugs are ironed out.
-  'SpacesTest.OffThreadLargeObjectSpaceMerge': [SKIP],
 }],  # tsan == True
 
 ##############################################################################