Revert "[cleanup] Remove PropertyArray::synchronized_length_and_hash"

This reverts commit cf35926a.

Reason for revert: Speculative revert for TSAN breakage which closed the tree, e.g. https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20stress-incremental-marking/3187/overview and https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN/36671/overview

Original change's description:
> [cleanup] Remove PropertyArray::synchronized_length_and_hash
>
> It was never stored with a release store, so can we use the loads as
> non-atomic ones.
>
> Bug: v8:7790
> Change-Id: Ife67e8650a5fb279ad808e5e68c2ab46ee3507c5
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2880541
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74493}

Bug: v8:7790
Change-Id: I4f942c46631117c6573ac16ca8464c24c1c23f6e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2886886
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74503}

src/objects/objects.cc

@@ -2332,7 +2332,8 @@ int HeapObject::SizeFromMap(Map map) const {
         SwissNameDictionary::unchecked_cast(*this).Capacity());
   }
   if (instance_type == PROPERTY_ARRAY_TYPE) {
-    return PropertyArray::SizeFor(PropertyArray::cast(*this).length());
+    return PropertyArray::SizeFor(
+        PropertyArray::cast(*this).synchronized_length());
   }
   if (instance_type == FEEDBACK_VECTOR_TYPE) {
     return FeedbackVector::SizeFor(

src/objects/property-array-inl.h

@@ -22,6 +22,7 @@ OBJECT_CONSTRUCTORS_IMPL(PropertyArray, HeapObject)
 CAST_ACCESSOR(PropertyArray)
 
 SMI_ACCESSORS(PropertyArray, length_and_hash, kLengthAndHashOffset)
+SYNCHRONIZED_SMI_ACCESSORS(PropertyArray, length_and_hash, kLengthAndHashOffset)
 
 Object PropertyArray::get(int index) const {
   PtrComprCageBase cage_base = GetPtrComprCageBase(*this);
@@ -63,6 +64,10 @@ void PropertyArray::initialize_length(int len) {
   set_length_and_hash(len);
 }
 
+int PropertyArray::synchronized_length() const {
+  return LengthField::decode(synchronized_length_and_hash());
+}
+
 int PropertyArray::Hash() const { return HashField::decode(length_and_hash()); }
 
 void PropertyArray::SetHash(int hash) {

src/objects/property-array.h

@@ -19,6 +19,9 @@ class PropertyArray : public HeapObject {
   // [length]: length of the array.
   inline int length() const;
 
+  // Get the length using acquire loads.
+  inline int synchronized_length() const;
+
   // This is only used on a newly allocated PropertyArray which
   // doesn't have an existing hash.
   inline void initialize_length(int length);