Always record all the slots of descriptor arrays to avoid crashes due to

src/objects-visiting-inl.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 610 matching lines @@
     // Already marked by marking map->GetBackPointer() above.
     ASSERT(transitions->IsMap() || transitions->IsUndefined());
   }
 
   // Since descriptor arrays are potentially shared, ensure that only the
   // descriptors that belong to this map are marked. The first time a
   // non-empty descriptor array is marked, its header is also visited. The slot
   // holding the descriptor array will be implicitly recorded when the pointer
   // fields of this map are visited.
   DescriptorArray* descriptors = map->instance_descriptors();
+  MarkCompactCollector* collector = heap->mark_compact_collector();
+
   if (StaticVisitor::MarkObjectWithoutPush(heap, descriptors) &&
       descriptors->length() > 0) {
+    // Record all keys and values in the descriptor array to ensure that they
+    // are updated if they are on evacuation candidates and are alive, but the
+    // descriptor array is not yet installed in the map that's adding the
+    // descriptors.
+    for (int i = 0; i < descriptors->number_of_descriptors(); i++) {
+      Object** key_slot = descriptors->GetKeySlot(i);
+      ASSERT((*key_slot)->IsHeapObject());
+      collector->RecordSlot(key_slot, key_slot, *key_slot);
+      Object** value_slot = descriptors->GetValueSlot(i);
+      if ((*value_slot)->IsHeapObject()) {
+        collector->RecordSlot(value_slot, value_slot, *value_slot);
+      }
+    }
     StaticVisitor::VisitPointers(heap,
         descriptors->GetFirstElementAddress(),
         descriptors->GetDescriptorEndSlot(0));
   }
   int start = 0;
   int end = map->NumberOfOwnDescriptors();
   if (start < end) {
-    StaticVisitor::VisitPointers(heap,
-        descriptors->GetDescriptorStartSlot(start),
-        descriptors->GetDescriptorEndSlot(end));
+    for (Object** p = descriptors->GetDescriptorStartSlot(start);
+         p < descriptors->GetDescriptorEndSlot(end);
+         p++) {
+      if ((*p)->IsHeapObject()) {
+        StaticVisitor::MarkObject(heap, HeapObject::cast(*p));
+      }
+    }
   }
 
   // Mark prototype dependent codes array but do not push it onto marking
   // stack, this will make references from it weak. We will clean dead
   // codes when we iterate over maps in ClearNonLiveTransitions.
   Object** slot = HeapObject::RawField(map, Map::kDependentCodeOffset);
   HeapObject* obj = HeapObject::cast(*slot);
-  heap->mark_compact_collector()->RecordSlot(slot, slot, obj);
+  collector->RecordSlot(slot, slot, obj);
   StaticVisitor::MarkObjectWithoutPush(heap, obj);
 
   // Mark the pointer fields of the Map. Since the transitions array has
   // been marked already, it is fine that one of these fields contains a
   // pointer to it.
   StaticVisitor::VisitPointers(heap,
       HeapObject::RawField(map, Map::kPointerFieldsBeginOffset),
       HeapObject::RawField(map, Map::kPointerFieldsEndOffset));
 }
 
@@ skipping 279 matching lines @@
   RelocIterator it(this, mode_mask);
   for (; !it.done(); it.next()) {
     it.rinfo()->template Visit<StaticVisitor>(heap);
   }
 }
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_OBJECTS_VISITING_INL_H_