Keep (Heap)TerminatedArray in a consistent state while building.

third_party/WebKit/Source/wtf/TerminatedArrayBuilder.h

Index: third_party/WebKit/Source/wtf/TerminatedArrayBuilder.h
diff --git a/third_party/WebKit/Source/wtf/TerminatedArrayBuilder.h b/third_party/WebKit/Source/wtf/TerminatedArrayBuilder.h
index b768a74e93cdf2047d6cbddf9d6e0cd764aaf3bb..618d99ae8909f28e25f01069d691741b163decf5 100644
--- a/third_party/WebKit/Source/wtf/TerminatedArrayBuilder.h
+++ b/third_party/WebKit/Source/wtf/TerminatedArrayBuilder.h
@@ -21,6 +21,7 @@ public:
         if (!m_array)
             return;
         m_capacity = m_count = m_array->size();
+        ASSERT(m_array->at(m_count - 1).isLastInArray());
     }
 
     void grow(size_t count)
@@ -31,11 +32,12 @@ public:
             ASSERT(!m_capacity);
             m_capacity = count;
             m_array = ArrayType<T>::Allocator::create(m_capacity);

[haraken, 2016/01/29 16:00:32]

What happens if a conservative GC hits during the Allocator::create?

[sof, 2016/01/29 16:28:43]

m_array will be empty, so there'll be a null pointer on the stack. Which
wouldn't be traced.

-            return;
+        } else {

[haraken, 2016/01/29 16:00:32]

Add:

  ASSERT(m_array->at(m_count - 1).isLastInArray());

[sof, 2016/01/29 16:28:43]

Done.

+            m_capacity += count;
+            m_array = ArrayType<T>::Allocator::resize(m_array.release(), m_capacity);
+            m_array->at(m_count - 1).setLastInArray(false);
         }
-        m_capacity += count;
-        m_array = ArrayType<T>::Allocator::resize(m_array.release(), m_capacity);
-        m_array->at(m_count - 1).setLastInArray(false);
+        m_array->at(m_capacity - 1).setLastInArray(true);
     }
 
     void append(const T& item)
@@ -43,13 +45,13 @@ public:
         RELEASE_ASSERT(m_count < m_capacity);
         ASSERT(!item.isLastInArray());
         m_array->at(m_count++) = item;
+        if (m_count == m_capacity)
+            m_array->at(m_capacity - 1).setLastInArray(true);
     }
 
     typename ArrayType<T>::Allocator::PassPtr release()
     {
         RELEASE_ASSERT(m_count == m_capacity);
-        if (m_array)
-            m_array->at(m_count - 1).setLastInArray(true);
         assertValid();
         return m_array.release();
     }