Fix Object::Clone heap corruption under concurrent sweeping.

Fix Object::Clone heap corruption under concurrent sweeping.

Don't clone the mark bit; for details,
see https://code.google.com/p/dart/issues/detail?id=21236

BUG=21236
R=iposva@google.com

Committed: https://code.google.com/p/dart/source/detail?r=40926

[Ivan Posva, 2014-10-06 05:18:53]

The change itself LGTM.

-Ivan

https://codereview.chromium.org/634443002/diff/1/runtime/vm/object.cc
File runtime/vm/object.cc (right):

https://codereview.chromium.org/634443002/diff/1/runtime/vm/object.cc#newcode...
runtime/vm/object.cc:1757: if ((space == Heap::kOld) &&
!raw_obj->IsRemembered()) {
We should discuss this condition in person. I am not convinced this is correct.

[koda, 2014-10-06 05:35:35]

https://codereview.chromium.org/634443002/diff/1/runtime/vm/object.cc
File runtime/vm/object.cc (right):

https://codereview.chromium.org/634443002/diff/1/runtime/vm/object.cc#newcode...
runtime/vm/object.cc:1757: if ((space == Heap::kOld) &&
!raw_obj->IsRemembered()) {
On 2014/10/06 05:18:53, Ivan Posva wrote:
> We should discuss this condition in person. I am not convinced this is
correct.

Agreed.

In general, this method seems awfully tricky to get right, considering new tags
might be added. We should go over all its uses to see whether it can be replaced
with something safer.

I will also add a check to --verify_before_gc that no objects are marked.

[koda, 2014-10-06 13:28:31]

Committed patchset #1 (id:1) manually as r40926 (presubmit successful).