[compiler] Fix Ref creation in ReadFeedbackForGlobalAccess

Fixed: v8:12154, v8:7790
Change-Id: Ib5f3617f6d992b5916faf623ddced06d6e81bbfd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3132960Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76602}

src/compiler/js-heap-broker.cc

@@ -615,10 +615,10 @@ ProcessedFeedback const& JSHeapBroker::ReadFeedbackForGlobalAccess(
     int const script_context_index =
         FeedbackNexus::ContextIndexBits::decode(number);
     int const context_slot_index = FeedbackNexus::SlotIndexBits::decode(number);
-    ContextRef context = MakeRef(
+    ContextRef context = MakeRefAssumeMemoryFence(
         this,
         target_native_context().script_context_table().object()->get_context(
-            script_context_index));
+            script_context_index, kAcquireLoad));
 
     base::Optional<ObjectRef> contents = context.get(context_slot_index);
     if (contents.has_value()) CHECK(!contents->IsTheHole());

src/objects/contexts-inl.h

@@ -48,7 +48,12 @@ Handle<Context> ScriptContextTable::GetContext(Isolate* isolate,
 
 Context ScriptContextTable::get_context(int i) const {
   DCHECK_LT(i, used(kAcquireLoad));
-  return Context::cast(this->get(i + kFirstContextSlotIndex));
+  return Context::cast(get(i + kFirstContextSlotIndex));
+}
+
+Context ScriptContextTable::get_context(int i, AcquireLoadTag tag) const {
+  DCHECK_LT(i, used(kAcquireLoad));
+  return Context::cast(get(i + kFirstContextSlotIndex, tag));
 }
 
 TQ_OBJECT_CONSTRUCTORS_IMPL(Context)

src/objects/contexts.cc

@@ -31,8 +31,7 @@ Handle<ScriptContextTable> ScriptContextTable::Extend(
     result = table;
   }
   DCHECK(script_context->IsScriptContext());
-  result->set(used + kFirstContextSlotIndex, *script_context);
-
+  result->set(used + kFirstContextSlotIndex, *script_context, kReleaseStore);
   result->set_used(used + 1, kReleaseStore);
   return result;
 }

src/objects/contexts.h

@@ -361,6 +361,7 @@ class ScriptContextTable : public FixedArray {
                                            Handle<ScriptContextTable> table,
                                            int i);
   inline Context get_context(int i) const;
+  inline Context get_context(int i, AcquireLoadTag tag) const;
 
   // Lookup a variable `name` in a ScriptContextTable.
   // If it returns true, the variable is found and `result` contains