[heap] fix crash during the scavenge of ArrayBuffer

src/heap/store-buffer.h

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_STORE_BUFFER_H_
 #define V8_STORE_BUFFER_H_
 
 #include "src/allocation.h"
 #include "src/base/logging.h"
 #include "src/base/platform/platform.h"
@@ skipping 43 matching lines @@
   // exempt from the store buffer and process the promotion queue.  These steps
   // can overflow this buffer.  We check for this and on overflow we call the
   // callback set up with the StoreBufferRebuildScope object.
   inline void EnterDirectlyIntoStoreBuffer(Address addr);
 
   // Iterates over all pointers that go from old space to new space.  It will
   // delete the store buffer as it starts so the callback should reenter
   // surviving old-to-new pointers into the store buffer to rebuild it.
   void IteratePointersToNewSpace(ObjectSlotCallback callback);
 
+  // Iterate pointers to from semispace of new space found in memory interval
+  // from start to end within |object|.
+  void IteratePointersToFromSpace(HeapObject* target, int size,

[Hannes Payer (out of office), 2015/10/23 11:41:19]

These methods should live in heap. They have nothing to do with the store buffer
(they can just create store buffer entries). Can you please move them to theap.

[indutny, 2015/10/23 15:17:09]

Acknowledged.

+                                  ObjectSlotCallback slot_callback);
+
   static const int kStoreBufferOverflowBit = 1 << (14 + kPointerSizeLog2);
   static const int kStoreBufferSize = kStoreBufferOverflowBit;
   static const int kStoreBufferLength = kStoreBufferSize / sizeof(Address);
   static const int kOldStoreBufferLength = kStoreBufferLength * 16;
   static const int kHashSetLengthLog2 = 12;
   static const int kHashSetLength = 1 << kHashSetLengthLog2;
 
   void Compact();
 
   void GCPrologue();
@@ skipping 77 matching lines @@
   // visit_pointer_region callback.
   // If either visit_pointer_region or callback can cause an allocation
   // in old space and changes in allocation watermark then
   // can_preallocate_during_iteration should be set to true.
   void IteratePointersOnPage(PagedSpace* space, Page* page,
                              RegionCallback region_callback,
                              ObjectSlotCallback slot_callback);
 
   void IteratePointersInStoreBuffer(ObjectSlotCallback slot_callback);
 
+  void IterateAndMarkPointersToFromSpace(HeapObject* object, Address start,

[Hannes Payer (out of office), 2015/10/23 11:41:19]

Same same.

[indutny, 2015/10/23 15:17:09]

Acknowledged.

+                                         Address end, bool record_slots,
+                                         ObjectSlotCallback slot_callback);
+
 #ifdef VERIFY_HEAP
   void VerifyPointers(LargeObjectSpace* space);
 #endif
 
   friend class StoreBufferRebuildScope;
   friend class DontMoveStoreBufferEntriesScope;
 };
 
 
 class StoreBufferRebuilder {
@@ skipping 53 matching lines @@
   }
 
  private:
   StoreBuffer* store_buffer_;
   bool stored_state_;
 };
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_STORE_BUFFER_H_