[heap] Use rel/acq for CodeRange::embedded_blob_code_copy_

Rel/acq is needed to guarantee the memcpy for re-embedding builtins
should be visible to all threads once embedded_blob_code_copy_ is
observed to have the address of the copy.

Bug: v8:11460
Change-Id: I68d0c532b7c7bba3d2cafeb0ff83533a67a1447d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2890590Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74529}

src/heap/code-range.cc

@@ -104,7 +104,7 @@ uint8_t* CodeRange::RemapEmbeddedBuiltins(Isolate* isolate,
   CHECK(!code_region.is_empty());
 
   uint8_t* embedded_blob_code_copy =
-      embedded_blob_code_copy_.load(std::memory_order_relaxed);
+      embedded_blob_code_copy_.load(std::memory_order_acquire);
   if (embedded_blob_code_copy) {
     DCHECK(
         code_region.contains(reinterpret_cast<Address>(embedded_blob_code_copy),
@@ -148,7 +148,7 @@ uint8_t* CodeRange::RemapEmbeddedBuiltins(Isolate* isolate,
   }
 
   embedded_blob_code_copy_.store(embedded_blob_code_copy,
-                                 std::memory_order_relaxed);
+                                 std::memory_order_release);
   return embedded_blob_code_copy;
 }
 

src/heap/code-range.h

@@ -85,7 +85,7 @@ class CodeRange final : public VirtualMemoryCage {
     // created by itself, i.e. without contention. Additionally, the first
     // Isolate usually remaps builtins on machines with enough memory, not
     // subsequent Isolates in the same process.
-    return embedded_blob_code_copy_.load(std::memory_order_relaxed);
+    return embedded_blob_code_copy_.load(std::memory_order_acquire);
   }
 
   bool InitReservation(v8::PageAllocator* page_allocator, size_t requested);