Push the fix for http://crbug.com/9746 to the 1.1 branch.

src/mark-compact.h

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 124 matching lines @@
   //
   //  Before: The heap has been prepared for garbage collection by
   //          MarkCompactCollector::Prepare() and is otherwise in its
   //          normal state.
   //
   //   After: Live objects are marked and non-live objects are unmarked.
 
 
   friend class RootMarkingVisitor;
   friend class MarkingVisitor;
+  friend class UnmarkingVisitor;
 
   // Marking operations for objects reachable from roots.
   static void MarkLiveObjects();
 
   static void MarkUnmarkedObject(HeapObject* obj);
 
   static inline void MarkObject(HeapObject* obj) {
     if (!obj->IsMarked()) MarkUnmarkedObject(obj);
   }
 
   static inline void SetMark(HeapObject* obj) {
     tracer_->increment_marked_count();
 #ifdef DEBUG
-    UpdateLiveObjectCount(obj);
+    UpdateLiveObjectCount(obj, 1);
 #endif
     obj->SetMark();
   }
 
   // Creates back pointers for all map transitions, stores them in
   // the prototype field.  The original prototype pointers are restored
   // in ClearNonLiveTransitions().  All JSObject maps
   // connected by map transitions have the same prototype object, which
   // is why we can use this field temporarily for back pointers.
   static void CreateBackPointers();
 
   // Mark a Map and its DescriptorArray together, skipping transitions.
   static void MarkMapContents(Map* map);
   static void MarkDescriptorArray(DescriptorArray* descriptors);
 
   // Mark the heap roots and all objects reachable from them.
-  static void ProcessRoots(RootMarkingVisitor* visitor);
+  static void MarkRoots(RootMarkingVisitor* visitor);
+
+  // Mark the symbol table specially.  References to symbols from the
+  // symbol table are weak.
+  static void MarkSymbolTable();
 
   // Mark objects in object groups that have at least one object in the
   // group marked.
   static void MarkObjectGroups();
 
   // Mark all objects in an object group with at least one marked
   // object, then all objects reachable from marked objects in object
   // groups, and repeat.
   static void ProcessObjectGroups(MarkingVisitor* visitor);
 
   // Mark objects reachable (transitively) from objects in the marking stack
   // or overflowed in the heap.
   static void ProcessMarkingStack(MarkingVisitor* visitor);
 
   // Mark objects reachable (transitively) from objects in the marking
   // stack.  This function empties the marking stack, but may leave
   // overflowed objects in the heap, in which case the marking stack's
   // overflow flag will be set.
   static void EmptyMarkingStack(MarkingVisitor* visitor);
 
   // Refill the marking stack with overflowed objects from the heap.  This
   // function either leaves the marking stack full or clears the overflow
   // flag on the marking stack.
   static void RefillMarkingStack();
 
   // Callback function for telling whether the object *p must be marked.
   static bool MustBeMarked(Object** p);
 
 #ifdef DEBUG
-  static void UpdateLiveObjectCount(HeapObject* obj);
+  // The scale argument is positive 1 if we are marking an object and
+  // -1 if we are clearing the mark bit of an object that we didn't
+  // actually want marked.
+  static void UpdateLiveObjectCount(HeapObject* obj, int scale);
 #endif
 
   // We sweep the large object space in the same way whether we are
   // compacting or not, because the large object space is never compacted.
   static void SweepLargeObjectSpace();
 
   // Test whether a (possibly marked) object is a Map.
   static inline bool SafeIsMap(HeapObject* object);
 
   // Map transitions from a live map to a dead map must be killed.
@@ skipping 182 matching lines @@
 
   friend class UnmarkObjectVisitor;
   static void UnmarkObject(HeapObject* obj);
 #endif
 };
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_MARK_COMPACT_H_