[heap, tsan] Annotate concurrent marking for TSAN

TSAN complains about missing synchronization on access to the page flags
because it does not support and recognize the memory fence we emit after
page initialization.

This adds a TSAN only acquire load to the code accesses page flags
similar to the existing load in MarkObject.

Bug: v8:9842
Change-Id: I34dac308ac1cce1d74a4a1bad95a482abc071595
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1856008Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64247}

src/heap/concurrent-marking.cc

@@ -224,6 +224,9 @@ class ConcurrentMarkingVisitor final
     }
     if (weak_ref.target().IsHeapObject()) {
       HeapObject target = HeapObject::cast(weak_ref.target());
+#ifdef THREAD_SANITIZER
+      MemoryChunk::FromHeapObject(target)->SynchronizedHeapLoad();
+#endif
       if (marking_state_.IsBlackOrGrey(target)) {
         // Record the slot inside the JSWeakRef, since the
         // VisitJSObjectSubclass above didn't visit it.
@@ -246,6 +249,9 @@ class ConcurrentMarkingVisitor final
     WeakCell::BodyDescriptor::IterateBody(map, weak_cell, size, this);
     if (weak_cell.target().IsHeapObject()) {
       HeapObject target = HeapObject::cast(weak_cell.target());
+#ifdef THREAD_SANITIZER
+      MemoryChunk::FromHeapObject(target)->SynchronizedHeapLoad();
+#endif
       if (marking_state_.IsBlackOrGrey(target)) {
         // Record the slot inside the WeakCell, since the IterateBody above
         // didn't visit it.
@@ -477,6 +483,9 @@ class ConcurrentMarkingVisitor final
       ObjectSlot key_slot =
           table.RawFieldOfElementAt(EphemeronHashTable::EntryToIndex(i));
       HeapObject key = HeapObject::cast(table.KeyAt(i));
+#ifdef THREAD_SANITIZER
+      MemoryChunk::FromHeapObject(key)->SynchronizedHeapLoad();
+#endif
       MarkCompactCollector::RecordSlot(table, key_slot, key);
 
       ObjectSlot value_slot =
@@ -490,6 +499,9 @@ class ConcurrentMarkingVisitor final
 
         if (value_obj.IsHeapObject()) {
           HeapObject value = HeapObject::cast(value_obj);
+#ifdef THREAD_SANITIZER
+          MemoryChunk::FromHeapObject(value)->SynchronizedHeapLoad();
+#endif
           MarkCompactCollector::RecordSlot(table, value_slot, value);
 
           // Revisit ephemerons with both key and value unreachable at end