ClusterFuzz reported a non-reproducible issue here:
  https://clusterfuzz.com/testcase-detail/4634185246244864

What happens here is that a LAB is replaced that is adjacent to a live
object that is concurrently being marked using the object start
bitmap.

Bug: chromium:1056170
Change-Id: Iebc0db6b85262f2f544a76bac9b3d1c662e41d6a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162603Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76865}