[heap] Verify mark bits when iterating mark bits.

src/heap/mark-compact.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/heap/mark-compact.h"
 
 #include "src/base/atomicops.h"
 #include "src/base/bits.h"
 #include "src/base/sys-info.h"
 #include "src/code-stubs.h"
@@ skipping 1470 matching lines @@
     MarkBit markbit = Marking::MarkBitFrom(object);
     if ((object->map() != filler_map) && Marking::IsGrey(markbit)) {
       Marking::GreyToBlack(markbit);
       PushBlack(object);
       if (marking_deque()->IsFull()) return;
     }
   }
 }
 
 
-static inline int MarkWordToObjectStarts(uint32_t mark_bits, Address base,
+static inline int MarkWordToObjectStarts(uint32_t mark_bits,
+                                         uint32_t next_mark_bits, Address base,
                                          Address* starts);
 
 
 void MarkCompactCollector::DiscoverGreyObjectsOnPage(MemoryChunk* p) {
   DCHECK(!marking_deque()->IsFull());
   DCHECK(strcmp(Marking::kWhiteBitPattern, "00") == 0);
   DCHECK(strcmp(Marking::kBlackBitPattern, "10") == 0);
   DCHECK(strcmp(Marking::kGreyBitPattern, "11") == 0);
   DCHECK(strcmp(Marking::kImpossibleBitPattern, "01") == 0);
 
@@ skipping 1764 matching lines @@
     skip_list->Clear();
   }
 
   intptr_t freed_bytes = 0;
   intptr_t max_freed_bytes = 0;
   int curr_region = -1;
 
   for (MarkBitCellIterator it(p); !it.Done(); it.Advance()) {
     Address cell_base = it.CurrentCellBase();
     MarkBit::CellType* cell = it.CurrentCell();
-    int live_objects = MarkWordToObjectStarts(*cell, cell_base, starts);
+    int live_objects =
+        MarkWordToObjectStarts(*cell, it.PeekNext(), cell_base, starts);
     int live_index = 0;
     for (; live_objects != 0; live_objects--) {
       Address free_end = starts[live_index++];
       if (free_end != free_start) {
         int size = static_cast<int>(free_end - free_start);
         if (free_space_mode == ZAP_FREE_SPACE) {
           memset(free_start, 0xcc, size);
         }
         freed_bytes = Free<parallelism>(space, free_list, free_start, size);
         max_freed_bytes = Max(freed_bytes, max_freed_bytes);
@@ skipping 82 matching lines @@
 
 
 bool MarkCompactCollector::VisitLiveObjects(MemoryChunk* page,
                                             HeapObjectVisitor* visitor,
                                             IterationMode mode) {
   Address offsets[16];
   for (MarkBitCellIterator it(page); !it.Done(); it.Advance()) {
     Address cell_base = it.CurrentCellBase();
     MarkBit::CellType* cell = it.CurrentCell();
     if (*cell == 0) continue;
-    int live_objects = MarkWordToObjectStarts(*cell, cell_base, offsets);
+    int live_objects =
+        MarkWordToObjectStarts(*cell, it.PeekNext(), cell_base, offsets);
     for (int i = 0; i < live_objects; i++) {
       HeapObject* object = HeapObject::FromAddress(offsets[i]);
       DCHECK(Marking::IsBlack(Marking::MarkBitFrom(object)));
       if (!visitor->Visit(object)) {
         if ((mode == kClearMarkbits) && (i > 0)) {
           page->markbits()->ClearRange(
               page->AddressToMarkbitIndex(page->area_start()),
               page->AddressToMarkbitIndex(offsets[i]));
         }
         return false;
       }
     }
     if (mode == kClearMarkbits) {
       *cell = 0;
     }
   }
   return true;
 }
 
 
 void MarkCompactCollector::VisitLiveObjectsBody(Page* page,
                                                 ObjectVisitor* visitor) {
   Address starts[16];
   for (MarkBitCellIterator it(page); !it.Done(); it.Advance()) {
     Address cell_base = it.CurrentCellBase();
     MarkBit::CellType* cell = it.CurrentCell();
     if (*cell == 0) continue;
-    int live_objects = MarkWordToObjectStarts(*cell, cell_base, starts);
+    int live_objects =
+        MarkWordToObjectStarts(*cell, it.PeekNext(), cell_base, starts);
     for (int i = 0; i < live_objects; i++) {
       HeapObject* live_object = HeapObject::FromAddress(starts[i]);
       DCHECK(Marking::IsBlack(Marking::MarkBitFrom(live_object)));
       Map* map = live_object->synchronized_map();
       int size = live_object->SizeFromMap(map);
       live_object->IterateBody(map->instance_type(), size, visitor);
     }
   }
 }
 
@@ skipping 223 matching lines @@
     CHECK(p->WasSwept());
     space->ReleasePage(p);
   }
   evacuation_candidates_.Rewind(0);
   compacting_ = false;
   heap()->FilterStoreBufferEntriesOnAboutToBeFreedPages();
   heap()->FreeQueuedChunks();
 }
 
 
+#ifdef VERIFY_HEAP
+static bool VerifyAllBlackObjects(uint32_t mark_bits, uint32_t next_mark_bits) {
+  // Check for overlapping mark bits.
+  if ((mark_bits & 0x80000000) && (next_mark_bits & 0x1)) return false;
+
+  unsigned index = 0;
+  while ((index = base::bits::CountTrailingZeros32(mark_bits)) != 32) {
+    if (index > 0) mark_bits >>= index;
+    if ((mark_bits & 0x3) == 0x3) {
+      // There should not be any grey (11) objects.
+      return false;
+    }
+    mark_bits &= 0xFFFFFFFE;
+  }
+  return true;
+}
+#endif  // VERIFY_HEAP
+
+
 // Takes a word of mark bits and a base address. Returns the number of objects
 // that start in the range.  Puts the object starts in the supplied array.
-static inline int MarkWordToObjectStarts(uint32_t mark_bits, Address base,
+static inline int MarkWordToObjectStarts(uint32_t mark_bits,
+                                         uint32_t next_mark_bits, Address base,
                                          Address* starts) {
   int objects = 0;
 
-  // No consecutive 1 bits.
-  DCHECK((mark_bits & 0x180) != 0x180);
-  DCHECK((mark_bits & 0x18000) != 0x18000);
-  DCHECK((mark_bits & 0x1800000) != 0x1800000);
+#ifdef VERIFY_HEAP
+  if (FLAG_verify_heap) {
+    CHECK(VerifyAllBlackObjects(mark_bits, next_mark_bits));
+  }
+#endif  // VERIFY_HEAP
 
   unsigned index = 0;
   while ((index = base::bits::CountTrailingZeros32(mark_bits)) != 32) {
     starts[objects++] = base + kPointerSize * index;
     mark_bits &= ~(1u << index);
   }
   return objects;
 }
 
 
@@ skipping 263 matching lines @@
     MarkBit mark_bit = Marking::MarkBitFrom(host);
     if (Marking::IsBlack(mark_bit)) {
       RelocInfo rinfo(isolate(), pc, RelocInfo::CODE_TARGET, 0, host);
       RecordRelocSlot(&rinfo, target);
     }
   }
 }
 
 }  // namespace internal
 }  // namespace v8