Do not shortcut cons string symbols during garbage collection....

src/mark-compact.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 203 matching lines @@
 // have been reached and marked but their children have not been visited yet.
 // After emptying the marking stack, we clear the overflow flag and traverse
 // the heap looking for objects marked as overflowed, push them on the stack,
 // and continue with marking.  This process repeats until all reachable
 // objects have been marked.
 
 static MarkingStack marking_stack;
 
 
 inline HeapObject* ShortCircuitConsString(Object** p) {
-  // Optimization: If the heap object pointed to by p is a cons string whose
-  // right substring is Heap::empty_string, update it in place to its left
-  // substring.  Return the updated value.
+  // Optimization: If the heap object pointed to by p is a non-symbol
+  // cons string whose right substring is Heap::empty_string, update
+  // it in place to its left substring.  Return the updated value.
   //
   // Here we assume that if we change *p, we replace it with a heap object
   // (ie, the left substring of a cons string is always a heap object).
   //
   // The check performed is:
-  //   object->IsConsString() &&
+  //   object->IsConsString() && !object->IsSymbol() &&
   //   (ConsString::cast(object)->second() == Heap::empty_string())
   // except the maps for the object and its possible substrings might be
   // marked.
   HeapObject* object = HeapObject::cast(*p);
   MapWord map_word = object->map_word();
   map_word.ClearMark();
   InstanceType type = map_word.ToMap()->instance_type();
-  if (type >= FIRST_NONSTRING_TYPE) return object;
+  if (type >= FIRST_NONSTRING_TYPE || (type & kIsSymbolMask) != 0) {
+    return object;
+  }
 
   StringRepresentationTag rep =
       static_cast<StringRepresentationTag>(type & kStringRepresentationMask);
   if (rep != kConsStringTag) return object;
 
   Object* second = reinterpret_cast<ConsString*>(object)->second();
   if (reinterpret_cast<String*>(second) != Heap::empty_string()) return object;
 
   // Since we don't have the object's start, it is impossible to update the
   // remembered set.  Therefore, we only replace the string with its left
@@ skipping 1526 matching lines @@
 
 void MarkCompactCollector::RebuildRSets() {
 #ifdef DEBUG
   ASSERT(state_ == RELOCATE_OBJECTS);
   state_ = REBUILD_RSETS;
 #endif
   Heap::RebuildRSets();
 }
 
 } }  // namespace v8::internal