Remove early bail-out in VisitWeakList to investigate chrasher.

src/heap/objects-visiting.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/heap/objects-visiting.h"
 
 namespace v8 {
 namespace internal {
@@ skipping 184 matching lines @@
                       bool stop_after_young) {
   Object* undefined = heap->undefined_value();
   Object* head = undefined;
   T* tail = NULL;
   MarkCompactCollector* collector = heap->mark_compact_collector();
   bool record_slots = MustRecordSlots(heap);
 
   while (list != undefined) {
     // Check whether to keep the candidate in the list.
     T* candidate = reinterpret_cast<T*>(list);
-    T* original_candidate = candidate;
 
     Object* retained = retainer->RetainAs(list);
     if (retained != NULL) {
       if (head == undefined) {
         // First element in the list.
         head = retained;
       } else {
         // Subsequent elements in the list.
         DCHECK(tail != NULL);
         WeakListVisitor<T>::SetWeakNext(tail, retained);
         if (record_slots) {
           Object** next_slot =
               HeapObject::RawField(tail, WeakListVisitor<T>::WeakNextOffset());
           collector->RecordSlot(next_slot, next_slot, retained);
         }
       }
       // Retained object is new tail.
       DCHECK(!retained->IsUndefined());
       candidate = reinterpret_cast<T*>(retained);
       tail = candidate;
 
       // tail is a live object, visit it.
       WeakListVisitor<T>::VisitLiveObject(heap, tail, retainer);
 
-      // The list of weak objects is usually order. It starts with objects
-      // recently allocated in the young generation followed by objects
-      // allocated in the old generation. When a migration failure happened,
-      // the list is not ordered until the next GC that has no migration
-      // failure.
-      // For young generation collections we just have to visit until the last
-      // young generation objects.
-      if (stop_after_young && !heap->migration_failure() &&
-          !heap->previous_migration_failure() &&
-          !heap->InNewSpace(original_candidate)) {
-        return head;
-      }
     } else {
       WeakListVisitor<T>::VisitPhantomObject(heap, candidate);
     }
 
     // Move to next element in the list.
     list = WeakListVisitor<T>::WeakNext(candidate);
   }
 
   // Terminate the list if there is one or more elements.
   if (tail != NULL) {
@@ skipping 225 matching lines @@
 
 template Object* VisitWeakList<JSArrayBufferView>(Heap* heap, Object* list,
                                                   WeakObjectRetainer* retainer,
                                                   bool stop_after_young);
 
 template Object* VisitWeakList<AllocationSite>(Heap* heap, Object* list,
                                                WeakObjectRetainer* retainer,
                                                bool stop_after_young);
 }
 }  // namespace v8::internal