Restore invariant (next of first deallocated must point to the head) before c...

src/global-handles.cc

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 147 matching lines @@
     // behavior.
     WeakReferenceCallback func = callback();
     if (func == NULL) return false;
 
     v8::Persistent<v8::Object> object = ToApi<v8::Object>(handle());
     {
       // Forbid reuse of destroyed nodes as they might be already deallocated.
       // It's fine though to reuse nodes that were destroyed in weak callback
       // as those cannot be deallocated until we are back from the callback.
       set_first_free(NULL);
+      if (first_deallocated()) {
+        first_deallocated()->set_next(head());
+      }
       // Leaving V8.
       VMState state(EXTERNAL);
       func(object, par);
     }
     return true;
   }
 
   // Place the handle address first to avoid offset computation.
   Object* object_;  // Storage for object pointer.
 
@@ skipping 85 matching lines @@
   Counters::global_handles.Increment();
   Node* result;
   if (first_free()) {
     // Take the first node in the free list.
     result = first_free();
     set_first_free(result->next_free());
   } else if (first_deallocated()) {
     // Next try deallocated list
     result = first_deallocated();
     set_first_deallocated(result->next_free());
+    ASSERT(result->next() == head());
     set_head(result);
   } else {
     // Allocate a new node.
     result = pool_.Allocate();
     result->set_next(head());
     set_head(result);
   }
   result->Initialize(value);
   return result->handle();
 }
@@ skipping 195 matching lines @@
 void GlobalHandles::RemoveObjectGroups() {
   List<ObjectGroup*>* object_groups = ObjectGroups();
   for (int i = 0; i< object_groups->length(); i++) {
     delete object_groups->at(i);
   }
   object_groups->Clear();
 }
 
 
 } }  // namespace v8::internal