Fix transferal of marking bits on array trimming.

src/mark-compact.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 348 matching lines @@
     mark_bit.Clear();
     mark_bit.Next().Clear();
   }
 }
 
 
 bool Marking::TransferMark(Address old_start, Address new_start) {
   // This is only used when resizing an object.
   ASSERT(MemoryChunk::FromAddress(old_start) ==
          MemoryChunk::FromAddress(new_start));
+
   // If the mark doesn't move, we don't check the color of the object.
   // It doesn't matter whether the object is black, since it hasn't changed
   // size, so the adjustment to the live data count will be zero anyway.
   if (old_start == new_start) return false;
 
   MarkBit new_mark_bit = MarkBitFrom(new_start);
-
-  if (heap_->incremental_marking()->IsMarking()) {
-    MarkBit old_mark_bit = MarkBitFrom(old_start);
-#ifdef DEBUG
-    ObjectColor old_color = Color(old_mark_bit);
-#endif
-    if (Marking::IsBlack(old_mark_bit)) {
-      Marking::MarkBlack(new_mark_bit);
-      old_mark_bit.Clear();
-      return true;
-    } else if (Marking::IsGrey(old_mark_bit)) {
-      old_mark_bit.Next().Clear();
-      heap_->incremental_marking()->WhiteToGreyAndPush(
-          HeapObject::FromAddress(new_start), new_mark_bit);
-      heap_->incremental_marking()->RestartIfNotMarking();
-    }
+  MarkBit old_mark_bit = MarkBitFrom(old_start);
 
 #ifdef DEBUG
-    ObjectColor new_color = Color(new_mark_bit);
-    ASSERT(new_color == old_color);
+  ObjectColor old_color = Color(old_mark_bit);
 #endif
-    return false;
+
+  if (Marking::IsBlack(old_mark_bit)) {
+    old_mark_bit.Clear();
+    Marking::MarkBlack(new_mark_bit);
+    return true;
+  } else if (Marking::IsGrey(old_mark_bit)) {
+    ASSERT(heap_->incremental_marking()->IsMarking());
+    old_mark_bit.Next().Clear();

[Vyacheslav Egorov (Chromium), 2011/09/22 11:59:02]

should not we clear both bits? (grey = 11)

[Michael Starzinger, 2011/09/22 13:03:02]

Done. You are right, didn't look into the grey case close enough. Nice catch!

+    heap_->incremental_marking()->WhiteToGreyAndPush(
+        HeapObject::FromAddress(new_start), new_mark_bit);
+    heap_->incremental_marking()->RestartIfNotMarking();
   }
-  MarkBit old_mark_bit = MarkBitFrom(old_start);
-  if (!old_mark_bit.Get()) {
-    return false;
-  }
-  new_mark_bit.Set();
-  return true;
+
+#ifdef DEBUG
+  ObjectColor new_color = Color(new_mark_bit);
+  ASSERT(new_color == old_color);
+#endif
+
+  return false;
 }
 
 
 const char* AllocationSpaceName(AllocationSpace space) {
   switch (space) {
     case NEW_SPACE: return "NEW_SPACE";
     case OLD_POINTER_SPACE: return "OLD_POINTER_SPACE";
     case OLD_DATA_SPACE: return "OLD_DATA_SPACE";
     case CODE_SPACE: return "CODE_SPACE";
     case MAP_SPACE: return "MAP_SPACE";
@@ skipping 2816 matching lines @@
     offset += 8;
   }
   return objects;
 }
 
 
 static inline Address DigestFreeStart(Address approximate_free_start,
                                       uint32_t free_start_cell) {
   ASSERT(free_start_cell != 0);
 
+  // No consecutive 1 bits.
+  ASSERT((free_start_cell & (free_start_cell << 1)) == 0);
+
   int offsets[16];
   uint32_t cell = free_start_cell;
   int offset_of_last_live;
   if ((cell & 0x80000000u) != 0) {
     // This case would overflow below.
     offset_of_last_live = 31;
   } else {
     // Remove all but one bit, the most significant.  This is an optimization
     // that may or may not be worthwhile.
     cell |= cell >> 16;
@@ skipping 10 matching lines @@
       approximate_free_start + offset_of_last_live * kPointerSize;
   HeapObject* last_live = HeapObject::FromAddress(last_live_start);
   Address free_start = last_live_start + last_live->Size();
   return free_start;
 }
 
 
 static inline Address StartOfLiveObject(Address block_address, uint32_t cell) {
   ASSERT(cell != 0);
 
+  // No consecutive 1 bits.
+  ASSERT((cell & (cell << 1)) == 0);
+
   int offsets[16];
   if (cell == 0x80000000u) {  // Avoid overflow below.
     return block_address + 31 * kPointerSize;
   }
   uint32_t first_set_bit = ((cell ^ (cell - 1)) + 1) >> 1;
   ASSERT((first_set_bit & cell) == first_set_bit);
   int live_objects = MarkWordToObjectStarts(first_set_bit, offsets);
   ASSERT(live_objects == 1);
   USE(live_objects);
   return block_address + offsets[0] * kPointerSize;
@@ skipping 344 matching lines @@
   while (buffer != NULL) {
     SlotsBuffer* next_buffer = buffer->next();
     DeallocateBuffer(buffer);
     buffer = next_buffer;
   }
   *buffer_address = NULL;
 }
 
 
 } }  // namespace v8::internal