[heap] NotifyObjectLayoutChange invalidates slots in OLD_TO_SHARED

When an object changes layout, OLD_TO_SHARED slots need to be
invalidated for it as well.

Bug: v8:11708
Change-Id: I28ea181012955fddef986e8f8806a7477307df28
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3596175Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80071}

src/heap/heap.cc

@@ -3969,6 +3969,8 @@ void Heap::NotifyObjectLayoutChange(
       MayContainRecordedSlots(object)) {
     MemoryChunk::FromHeapObject(object)
         ->RegisterObjectWithInvalidatedSlots<OLD_TO_NEW>(object);
+    MemoryChunk::FromHeapObject(object)
+        ->RegisterObjectWithInvalidatedSlots<OLD_TO_SHARED>(object);
   }
 #ifdef VERIFY_HEAP
   if (FLAG_verify_heap) {