Arm64: testGCShadow assert fires when using DOTNET_HeapVerify=2

Description

When running the ReliabilityFramework with DOTNET_HeapVerify=2, the test exits in a few seconds with:

Assert failure(PID 978145 [0x000eece1], Thread: 979213 [0xef10d]): !"Pointer updated without using write barrier"
    File: /mnt/sda/home/alahay01/dotnet/runtime_table/src/coreclr/gc/gc.cpp:53068
    Image: /mnt/sda/home/alahay01/dotnet/runtime_table/artifacts/tests/coreclr/linux.arm64.Checked/Tests/Core_Root/corerun

This is the assert in testGCShadow().

Looking at the big comment in testGCShadow(), it suggests that there is a known issue but that that issue has been mitigated by the use of INVALIDGCVALUE. So, I think this is a different bug (possibly related).

Reproduction Steps

./src/tests/build.sh Checked
export CORE_ROOT=$(pwd)/artifacts/tests/coreclr/linux.arm64.Checked/Tests/Core_Root
export RunningLongGCTests=1
export DOTNET_HeapVerify=2
cd artifacts/tests/coreclr/linux.arm64.Checked/GC/Stress/Framework/ReliabilityFramework
./ReliabilityFramework.sh

Expected behavior

Test runs to completion.

Actual behavior

❯ time ./ReliabilityFramework.sh
BEGIN EXECUTION
/home/alahay01/dotnet/runtime_base/artifacts/tests/coreclr/linux.arm64.Checked/Tests/Core_Root/corerun -p System.Reflection.Metadata.MetadataUpdater.IsSupported=false -p System.Runtime.Serialization.EnableUnsafeBinaryFormatterSerialization=true ReliabilityFramework.dll '-unittest'
Using config file: /mnt/sda/home/alahay01/dotnet/runtime_table/artifacts/tests/coreclr/linux.arm64.Checked/GC/Stress/Framework/ReliabilityFramework/testmix_gc_ci.config
NUMBER_OF_PROCESSORS environment variable not supplied, falling back to Environment
test is 573277.dll
test is allocationwithpins.dll
test is b115557.dll
test is bestfit-finalize.dll
test is concurrentspin2.dll
test is doubLinkStay.dll
test is ExpandHeap.dll
test is GCQueue.dll
test is GCSimulator.dll
test is GCVariant.dll
test is LeakGenThrd.dll
test is MulDimJagAry.dll
test is pinstress.dll
test is plug.dll
test is PlugGaps.dll
test is SingLinkStay.dll
test is StressAllocator.dll
test is StressAllocator.dll
test is ThdTreeGrowingObj.dll
Loading all tests: ...................

Assert failure(PID 1461399 [0x00164c97], Thread: 1461558 [0x164d36]): !"Pointer updated without using write barrier"
    File: /mnt/sda/home/alahay01/dotnet/runtime_base/src/coreclr/gc/gc.cpp:53068
    Image: /mnt/sda/home/alahay01/dotnet/runtime_base/artifacts/tests/coreclr/linux.arm64.Checked/Tests/Core_Root/corerun

./ReliabilityFramework.sh: line 454: 1461399 Aborted                 (core dumped) $LAUNCHER $ExePath "${CLRTestExecutionArguments[@]}"
Expected: 100
Actual: 134
END EXECUTION - FAILED
./ReliabilityFramework.sh  1.80s user 0.20s system 104% cpu 1.921 total

Regression?

Unknown.

Known Workarounds

unset DOTNET_HeapVerify

Configuration

Cobalt 100
8 Cores, 32Gb
Ubuntu 24.04.1 LTS

Head: 0e03405bd25 2025-01-09.. Adam Sitnik don't run drawing tests on Mono (#111208)

Other information

No response