Fix GC-induced DCHECK failure in Runtime_GetWeakMapEntries

src/runtime/runtime-collections.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/arguments.h"
 #include "src/runtime/runtime-utils.h"
 
 
@@ skipping 248 matching lines @@
   CONVERT_ARG_HANDLE_CHECKED(JSWeakCollection, holder, 0);
   CONVERT_NUMBER_CHECKED(int, max_entries, Int32, args[1]);
   RUNTIME_ASSERT(max_entries >= 0);
 
   Handle<ObjectHashTable> table(ObjectHashTable::cast(holder->table()));
   if (max_entries == 0 || max_entries > table->NumberOfElements()) {
     max_entries = table->NumberOfElements();
   }
   Handle<FixedArray> entries =
       isolate->factory()->NewFixedArray(max_entries * 2);
+  // Allocation can cause GC can delete weak elements. Reload.
+  if (max_entries > table->NumberOfElements()) {
+    max_entries = table->NumberOfElements();
+  }
+
   {
     DisallowHeapAllocation no_gc;
     int count = 0;
     for (int i = 0; count / 2 < max_entries && i < table->Capacity(); i++) {
       Handle<Object> key(table->KeyAt(i), isolate);
       if (table->IsKey(*key)) {
         entries->set(count++, *key);
         Object* value = table->Lookup(key);
         entries->set(count++, value);
       }
@@ skipping 151 matching lines @@
 
 RUNTIME_FUNCTION(Runtime_ObservationWeakMapCreate) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 0);
   Handle<JSWeakMap> weakmap = isolate->factory()->NewJSWeakMap();
   Runtime::WeakCollectionInitialize(isolate, weakmap);
   return *weakmap;
 }
 }
 }  // namespace v8::internal