Filter invalid slots after array trimming.

src/heap/slot-set.h

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_SLOT_SET_H
 #define V8_SLOT_SET_H
 
 #include "src/allocation.h"
 #include "src/base/bits.h"
 
@@ skipping 56 matching lines @@
     int start_bucket, start_cell, start_bit;
     SlotToIndices(start_offset, &start_bucket, &start_cell, &start_bit);
     int end_bucket, end_cell, end_bit;
     SlotToIndices(end_offset, &end_bucket, &end_cell, &end_bit);
     uint32_t start_mask = (1u << start_bit) - 1;
     uint32_t end_mask = ~((1u << end_bit) - 1);
     if (start_bucket == end_bucket && start_cell == end_cell) {
       MaskCell(start_bucket, start_cell, start_mask | end_mask);
       return;
     }
-    MaskCell(start_bucket, start_cell, start_mask);
-    start_cell++;
-    if (bucket[start_bucket] != nullptr && start_bucket < end_bucket) {
-      while (start_cell < kCellsPerBucket) {
-        bucket[start_bucket][start_cell] = 0;
-        start_cell++;
+    uint32_t current_bucket = start_bucket;

[ulan, 2016/02/16 19:42:25]

Rewrote these parts to make invariants more obvious.

+    uint32_t current_cell = start_cell;
+    MaskCell(current_bucket, current_cell, start_mask);
+    current_cell++;
+    if (bucket[current_bucket] != nullptr && current_bucket < end_bucket) {
+      while (current_cell < kCellsPerBucket) {
+        bucket[current_bucket][current_cell] = 0;
+        current_cell++;
       }
+      // The current bucket is cleared. Move on to the next bucket.
+      current_bucket++;
+      current_cell = 0;

[ulan, 2016/02/16 19:42:25]

This was the bug in this function.

     }
-    while (start_bucket < end_bucket) {
-      delete[] bucket[start_bucket];
-      bucket[start_bucket] = nullptr;
-      start_bucket++;
+    DCHECK(current_bucket == end_bucket ||
+           (current_bucket < end_bucket && current_cell == 0));
+    while (current_bucket < end_bucket) {
+      delete[] bucket[current_bucket];
+      bucket[current_bucket] = nullptr;
+      current_bucket++;
     }
-    if (start_bucket < kBuckets && bucket[start_bucket] != nullptr) {
-      while (start_cell < end_cell) {
-        bucket[start_bucket][start_cell] = 0;
-        start_cell++;
-      }
+    // All buckets between start_bucket and end_bucket are cleared.
+    DCHECK(current_bucket == end_bucket && current_cell <= end_cell);
+    if (current_bucket == kBuckets || bucket[current_bucket] == nullptr) {
+      return;
     }
-    if (end_bucket < kBuckets) {
-      MaskCell(end_bucket, end_cell, end_mask);
+    while (current_cell < end_cell) {
+      bucket[current_bucket][current_cell] = 0;
+      current_cell++;
     }
+    // All cells between start_cell and end_cell are cleared.
+    DCHECK(current_bucket == end_bucket && current_cell == end_cell);
+    MaskCell(end_bucket, end_cell, end_mask);
   }
 
   // The slot offset specifies a slot at address page_start_ + slot_offset.
   bool Lookup(int slot_offset) {
     int bucket_index, cell_index, bit_index;
     SlotToIndices(slot_offset, &bucket_index, &cell_index, &bit_index);
     if (bucket[bucket_index] != nullptr) {
       uint32_t cell = bucket[bucket_index][cell_index];
       return (cell & (1u << bit_index)) != 0;
     }
@@ skipping 89 matching lines @@
   }
 
   uint32_t* bucket[kBuckets];
   Address page_start_;
 };
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_SLOT_SET_H