Fix bug in Page::GetRegionMaskForSpan.

src/spaces-inl.h

 // Copyright 2006-2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 137 matching lines @@
 }
 
 
 uint32_t Page::GetRegionMaskForAddress(Address addr) {
   return 1 << GetRegionNumberForAddress(addr);
 }
 
 
 uint32_t Page::GetRegionMaskForSpan(Address start, int length_in_bytes) {
   uint32_t result = 0;
-  if (length_in_bytes >= kPageSize) {
+  static const intptr_t kRegionMask = (1 << kRegionSizeLog2) - 1;
+  if (length_in_bytes + (OffsetFrom(start) & kRegionMask) >= kPageSize) {
     result = kAllRegionsDirtyMarks;
   } else if (length_in_bytes > 0) {
     int start_region = GetRegionNumberForAddress(start);
     int end_region =
         GetRegionNumberForAddress(start + length_in_bytes - kPointerSize);
     uint32_t start_mask = (~0) << start_region;
     uint32_t end_mask = ~((~1) << end_region);
     result = start_mask & end_mask;
     // if end_region < start_region, the mask is ored.
     if (result == 0) result = start_mask | end_mask;
@@ skipping 305 matching lines @@
 
 bool FreeListNode::IsFreeListNode(HeapObject* object) {
   return object->map() == HEAP->raw_unchecked_byte_array_map()
       || object->map() == HEAP->raw_unchecked_one_pointer_filler_map()
       || object->map() == HEAP->raw_unchecked_two_pointer_filler_map();
 }
 
 } }  // namespace v8::internal
 
 #endif  // V8_SPACES_INL_H_