cppgc: Fix re-tracing weak containers

Weak containers are re-traced during conservative stack scanning to
strongify their contents. This runs in parallel with concurrent
marking that could find new weak containers.

The CL fixes two issues:
- The concurrent marker could find a weak container and mark it but
  would only add it to the set of weak containers afterwards. We need to
  reverse this (using a lock) to make sure that the main thread sees the
  marked weak container.
- The DCHECK for containment needs to be concurrency aware.

Bug: chromium:1349298
Change-Id: I1ec31db62647f7f1c19e9cc60976e09946551333
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3807593Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82170}

src/heap/cppgc/marking-state.h

@@ -294,12 +294,12 @@ void BasicMarkingState::ProcessWeakContainer(const void* object,
     return;
   }
 
+  RegisterWeakContainer(header);
+
   // Only mark the container initially. Its buckets will be processed after
   // marking.
   if (!MarkNoPush(header)) return;
 
-  RegisterWeakContainer(header);
-
   // Register final weak processing of the backing store.
   RegisterWeakCallback(callback, data);
 
@@ -409,7 +409,7 @@ class MutatorMarkingState : public BasicMarkingState {
 
 void MutatorMarkingState::ReTraceMarkedWeakContainer(cppgc::Visitor& visitor,
                                                      HeapObjectHeader& header) {
-  DCHECK(weak_containers_worklist_.Contains(&header));
+  DCHECK(weak_containers_worklist_.Contains<AccessMode::kAtomic>(&header));
   recently_retraced_weak_containers_.Insert(&header);
   retrace_marked_objects_worklist().Push(&header);
 }