Added a test which installs a poisonous memento right after the new space top pointer.

Added a test which installs a poisonous memento right after the new space top pointer.

BUG=
R=bmeurer@chromium.org, mvstanton@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=19066

[Benedikt Meurer, 2014-02-04 08:27:44]

https://codereview.chromium.org/152813003/diff/20001/test/cctest/test-memento...
File test/cctest/test-mementos.cc (right):

https://codereview.chromium.org/152813003/diff/20001/test/cctest/test-memento...
test/cctest/test-mementos.cc:45: CompileRun("var a = [];");
This is rather fragile. Why not simply call the Heap method to allocate a
JSArray and manually stick an AllocationMemento after the new top pointer?

[mvstanton, 2014-02-04 09:01:11]

lgtm, a couple comments.

https://codereview.chromium.org/152813003/diff/20001/test/cctest/test-memento...
File test/cctest/test-mementos.cc (right):

https://codereview.chromium.org/152813003/diff/20001/test/cctest/test-memento...
test/cctest/test-mementos.cc:45: CompileRun("var a = [];");
On 2014/02/04 08:27:44, Benedikt Meurer wrote:
> This is rather fragile. Why not simply call the Heap method to allocate a
> JSArray and manually stick an AllocationMemento after the new top pointer?

But since mementos are a part of the code now (there is no longer a flag to
control this), I'd say go ahead and trust that a memento will be emitted. You
could assert that the word after the JSArray is the memento map.

https://codereview.chromium.org/152813003/diff/20001/test/cctest/test-memento...
test/cctest/test-mementos.cc:60:
heap->CollectAllGarbage(Heap::kAbortIncrementalMarkingMask);
Have you verified that crash would happen here?

[Hannes Payer (out of office), 2014-02-04 11:59:31]

https://codereview.chromium.org/152813003/diff/20001/test/cctest/test-memento...
File test/cctest/test-mementos.cc (right):

https://codereview.chromium.org/152813003/diff/20001/test/cctest/test-memento...
test/cctest/test-mementos.cc:45: CompileRun("var a = [];");
On 2014/02/04 09:01:11, mvstanton wrote:
> On 2014/02/04 08:27:44, Benedikt Meurer wrote:
> > This is rather fragile. Why not simply call the Heap method to allocate a
> > JSArray and manually stick an AllocationMemento after the new top pointer?
> 
> But since mementos are a part of the code now (there is no longer a flag to
> control this), I'd say go ahead and trust that a memento will be emitted. You
> could assert that the word after the JSArray is the memento map. 

We can do that as well.

https://codereview.chromium.org/152813003/diff/20001/test/cctest/test-memento...
test/cctest/test-mementos.cc:60:
heap->CollectAllGarbage(Heap::kAbortIncrementalMarkingMask);
On 2014/02/04 09:01:11, mvstanton wrote:
> Have you verified that crash would happen here?

Yes, it would crash without the fix.

[Benedikt Meurer, 2014-02-04 12:00:39]

LGTM

[Hannes Payer (out of office), 2014-02-04 12:10:37]

Committed patchset #3 manually as r19066 (presubmit successful).