[gc][static-roots] Fix more accesses to r/o markbits

Two overlooked ones in marking barrier and cppgc.

Fixes blink tests.

Bug: v8:13717
Change-Id: I2c8beb0db1bcc38ae37a058f02da448dae9c7207
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4224152
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Auto-Submit: Olivier Flückiger <olivf@chromium.org>
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85692}

src/heap/cppgc-js/unified-heap-marking-state-inl.h

@@ -46,6 +46,7 @@ void UnifiedHeapMarkingState::MarkAndPush(
     return;
   }
   HeapObject heap_object = HeapObject::cast(object);
+  if (heap_object.InReadOnlySpace()) return;
   if (marking_state_->WhiteToGrey(heap_object)) {
     local_marking_worklist_->Push(heap_object);
   }

src/heap/marking-barrier-inl.h

@@ -72,6 +72,7 @@ void MarkingBarrier::MarkValueShared(HeapObject value) {
 }
 
 void MarkingBarrier::MarkValueLocal(HeapObject value) {
+  DCHECK(!value.InReadOnlySpace());
   if (is_minor()) {
     // We do not need to insert into RememberedSet<OLD_TO_NEW> here because the
     // C++ marking barrier already does this for us.

src/heap/marking-barrier.cc

@@ -60,7 +60,7 @@ void MarkingBarrier::WriteWithoutHost(HeapObject value) {
       return;
     }
   }
-
+  if (value.InReadOnlySpace()) return;
   MarkValueLocal(value);
 }