[heap] Fix data race in YoungGenerationMarkingVisitorBase

This CL fixes a data race that was found using TSAN.

Bug: v8:13012
Change-Id: Ic29620edce116effea097a9f1d58532ba93b2224
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3857424Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Leon Bettscheider <bettscheider@google.com>
Cr-Commit-Position: refs/heads/main@{#82738}

src/heap/marking-visitor-inl.h

@@ -602,7 +602,8 @@ template <typename TSlot>
 void YoungGenerationMarkingVisitorBase<
     ConcreteVisitor, MarkingState>::VisitPointerImpl(HeapObject host,
                                                      TSlot slot) {
-  typename TSlot::TObject target = *slot;
+  typename TSlot::TObject target =
+      slot.Relaxed_Load(ObjectVisitorWithCageBases::cage_base());
   if (Heap::InYoungGeneration(target)) {
     // Treat weak references as strong.
     HeapObject target_object = target.GetHeapObject();