fix(patch): mark ephemeron values reached from resurrected finalizer keys

* The resurrection closure drained via `MarkTransitiveClosureFixpoint()` in
  the default worklist mode. Once the main closure ends in
  `MarkTransitiveClosureLinear()`, unresolved ephemerons live in
  `key_to_values_` rather than `next_ephemerons`, and only the
  `kProcessRememberedEphemerons` mode consults that map -- so the values of
  a resurrected WeakMap key were never marked.
* Linear is the common terminal path, not a rare fallback: `ProcessEphemeron`
  reports progress for every `kUnresolved` entry, so a single persistently
  unresolved ephemeron spins the fixpoint out to its iteration cap. A
  resurrected key is itself such an entry, so the objects that trigger the
  bug are the same ones that force the algorithm that exposes it.
* `ClearWeakCollections()` keeps any entry whose key is marked and inspects
  the value only under VERIFY_HEAP, so the entry survived into a live table
  with a value pointing at a page that sweeping then released.
* Drain in remembered-ephemerons mode before the fixpoint/linear pair. Sound
  unconditionally: fixpoint success implies `key_to_values_` is empty, so the
  block needs no flag telling it which algorithm ended the main closure, and
  neither `SetKeyToValues`' nor `MarkTransitiveClosureLinear`'s DCHECK can
  fire. `VerifyEphemeronMarking()` afterwards is a no-op outside
  --verify-heap builds.

Author: edusperoni

patches/v8_resurrecting_finalizers.patch

@@ -339,7 +339,7 @@ diff --git a/src/heap/mark-compact.cc b/src/heap/mark-compact.cc
 index b65cd3af3e0..d81667a115e 100644
 --- a/src/heap/mark-compact.cc
 +++ b/src/heap/mark-compact.cc
-@@ -2661,6 +2661,31 @@ void MarkCompactCollector::MarkLiveObjects() {
+@@ -2661,6 +2661,43 @@ void MarkCompactCollector::MarkLiveObjects() {
      VerifyEphemeronMarking();
    }
 
@@ -359,13 +359,25 @@ index b65cd3af3e0..d81667a115e 100644
 +        &IsUnmarkedHeapObject);
 +    heap_->isolate()->global_handles()->IterateFinalizerHandlesAsRoots(
 +        &root_visitor);
++    // Once the closure above ends in `MarkTransitiveClosureLinear()`,
++    // unresolved ephemerons live in `key_to_values_`, which only the
++    // `kProcessRememberedEphemerons` worklist mode consults. Draining the
++    // resurrected closure in any other mode marks a resurrected WeakMap key
++    // while leaving its value unmarked; `ClearWeakCollections()` tests only
++    // the key, so the entry survives with a dangling value slot. When the
++    // closure reached its fixpoint instead, the map is empty and this is a
++    // plain worklist drain.
++    ReachTransitiveClosureWithEmbedder<
++        MarkingWorklistProcessingMode::kProcessRememberedEphemerons>();
 +    if (!MarkTransitiveClosureFixpoint()) {
 +      MarkTransitiveClosureLinear();
 +    }
++    local_weak_objects()->ephemeron_hash_tables_local.Publish();
 +    CHECK(local_marking_worklists_->IsEmpty());
 +    CHECK(
 +        local_weak_objects()->current_ephemerons_local.IsLocalAndGlobalEmpty());
 +    CHECK(IsCppHeapMarkingFinished(heap_, local_marking_worklists_.get()));
++    VerifyEphemeronMarking();
 +  }
 +
    if (was_marked_incrementally) {