Filter out invalid slots in store buffer eagerly during object transition.

src/heap/store-buffer.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/heap/store-buffer.h"
 
 #include <algorithm>
 
 #include "src/counters.h"
 #include "src/heap/incremental-marking.h"
@@ skipping 45 matching lines @@
   start_ = limit_ = NULL;
   heap_->set_store_buffer_top(reinterpret_cast<Smi*>(start_));
 }
 
 
 void StoreBuffer::StoreBufferOverflow(Isolate* isolate) {
   isolate->heap()->store_buffer()->InsertEntriesFromBuffer();
   isolate->counters()->store_buffer_overflows()->Increment();
 }
 
+void StoreBuffer::Remove(Address addr) {
+  InsertEntriesFromBuffer();
+  MemoryChunk* chunk = MemoryChunk::FromAddress(addr);
+  DCHECK_EQ(chunk->owner()->identity(), OLD_SPACE);
+  uintptr_t offset = addr - chunk->address();
+  DCHECK_LT(offset, static_cast<uintptr_t>(Page::kPageSize));
+  if (chunk->old_to_new_slots() == nullptr) return;
+  chunk->old_to_new_slots()->Remove(static_cast<uint32_t>(offset));
+}
 
 #ifdef VERIFY_HEAP
 void StoreBuffer::VerifyPointers(LargeObjectSpace* space) {
   LargeObjectIterator it(space);
   for (HeapObject* object = it.Next(); object != NULL; object = it.Next()) {
     if (object->IsFixedArray()) {
       Address slot_address = object->address();
       Address end = object->address() + object->Size();
       while (slot_address < end) {
         HeapObject** slot = reinterpret_cast<HeapObject**>(slot_address);
@@ skipping 134 matching lines @@
       CHECK(heap->InNewSpace(object));
       heap->mark_compact_collector()->VerifyIsSlotInLiveObject(
           reinterpret_cast<Address>(slot), HeapObject::cast(object));
     }
     return SlotSet::KEEP_SLOT;
   });
 }
 
 }  // namespace internal
 }  // namespace v8