[v8] Fix data race in TRACE_EVENT macros in cppgc

Mirrors a Chromium change @
https://chromium-review.googlesource.com/c/chromium/src/+/3680123
and a v8 change @
https://chromium-review.googlesource.com/c/v8/v8/+/3687370/

Bug: chromium:1330114
Change-Id: I61b1e34d54a496dda25936efbcd339fa35e64fb1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3686476
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Auto-Submit: Gabriel Charette <gab@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80964}

src/heap/cppgc/trace-event.h

@@ -70,10 +70,14 @@ enum CategoryGroupEnabledFlags {
 #define TRACE_EVENT_API_ADD_TRACE_EVENT cppgc::internal::AddTraceEventImpl
 
 // Defines atomic operations used internally by the tracing system.
+// Acquire/release barriers are important here: crbug.com/1330114#c8.
 #define TRACE_EVENT_API_ATOMIC_WORD v8::base::AtomicWord
-#define TRACE_EVENT_API_ATOMIC_LOAD(var) v8::base::Relaxed_Load(&(var))
+#define TRACE_EVENT_API_ATOMIC_LOAD(var) v8::base::Acquire_Load(&(var))
 #define TRACE_EVENT_API_ATOMIC_STORE(var, value) \
-  v8::base::Relaxed_Store(&(var), (value))
+  v8::base::Release_Store(&(var), (value))
+// This load can be Relaxed because it's reading the state of
+// `category_group_enabled` and not inferring other variable's state from the
+// result.
 #define TRACE_EVENT_API_LOAD_CATEGORY_GROUP_ENABLED()                \
   v8::base::Relaxed_Load(reinterpret_cast<const v8::base::Atomic8*>( \
       INTERNAL_TRACE_EVENT_UID(category_group_enabled)))