[compiler] MakeRefAssumeMemoryFence in ReadFeedbackForGlobalAccess

Feedback is protected by acquire-release.

Bug: v8:7790
Change-Id: I5b9e8f2fa8109207420dd715407c0791fe47db8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3068943
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76057}

src/compiler/js-heap-broker.cc

@@ -649,7 +649,9 @@ ProcessedFeedback const& JSHeapBroker::ReadFeedbackForGlobalAccess(
   // The wanted name belongs (or did belong) to a property on the global
   // object and the feedback is the cell holding its value.
   return *zone()->New<GlobalAccessFeedback>(
-      MakeRef(this, Handle<PropertyCell>::cast(feedback_value)), nexus.kind());
+      MakeRefAssumeMemoryFence(this,
+                               Handle<PropertyCell>::cast(feedback_value)),
+      nexus.kind());
 }
 
 ProcessedFeedback const& JSHeapBroker::ReadFeedbackForBinaryOperation(