The collector could scan a thread in a GC-free zone without seeing its last writes #169

A thread entering a GC-free zone saves its registers and stack bounds and then sets mGCFreeZone, a plain volatile bool. A collector that reads it as true skips waiting for that thread and scans what it saved. Nothing ordered the saves before the flag, so on ARM64 and other weakly ordered CPUs the collector could scan stale registers and miss an object held only there. Anything else the thread wrote before entering, such as the Haxe finalizer map, was likewise unordered with the collector's reads. ThreadSanitizer reported it as races between MarkConservative and the thread's own code, and between RunFinalizers and GCSetHaxeFinalizer.