Version 5.0.71.2 (cherry-pick)

test/cctest/test-unboxed-doubles.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdlib.h>
 #include <utility>
 
 #include "src/v8.h"
 
 #include "src/compilation-cache.h"
 #include "src/execution.h"
 #include "src/factory.h"
 #include "src/field-type.h"
 #include "src/global-handles.h"
+#include "src/heap/slots-buffer.h"
 #include "src/ic/ic.h"
 #include "src/macro-assembler.h"
 #include "test/cctest/cctest.h"
 #include "test/cctest/heap/utils-inl.h"
 
 using namespace v8::base;
 using namespace v8::internal;
 
 #if V8_DOUBLE_FIELDS_UNBOXING
 
@@ skipping 1441 matching lines @@
 
   // Check that everything is ready for triggering incremental write barrier
   // (i.e. that both |obj| and |obj_value| are black and the marking phase is
   // still active and |obj_value|'s page is indeed an evacuation candidate).
   IncrementalMarking* marking = heap->incremental_marking();
   CHECK(marking->IsMarking());
   CHECK(Marking::IsBlack(Marking::MarkBitFrom(*obj)));
   CHECK(Marking::IsBlack(Marking::MarkBitFrom(*obj_value)));
   CHECK(MarkCompactCollector::IsOnEvacuationCandidate(*obj_value));
 
-  // Trigger incremental write barrier, which should add a slot to remembered
-  // set.
+  // Trigger incremental write barrier, which should add a slot to |ec_page|'s
+  // slots buffer.
   {
+    int slots_buffer_len = SlotsBuffer::SizeOfChain(ec_page->slots_buffer());
     FieldIndex index = FieldIndex::ForDescriptor(*map, tagged_descriptor);
-    obj->FastPropertyAtPut(index, *obj_value);
+    const int n = SlotsBuffer::kNumberOfElements + 10;
+    for (int i = 0; i < n; i++) {
+      obj->FastPropertyAtPut(index, *obj_value);
+    }
+    // Ensure that the slot was actually added to the |ec_page|'s slots buffer.
+    CHECK_EQ(slots_buffer_len + n,
+             SlotsBuffer::SizeOfChain(ec_page->slots_buffer()));
   }
 
   // Migrate |obj| to |new_map| which should shift fields and put the
   // |boom_value| to the slot that was earlier recorded by incremental write
   // barrier.
   JSObject::MigrateToMap(obj, new_map);
 
   double boom_value = bit_cast<double>(UINT64_C(0xbaad0176a37c28e1));
 
   FieldIndex double_field_index =
@@ skipping 63 matching lines @@
 
 // TODO(ishell): add respective tests for property kind reconfiguring from
 // accessor field to double, once accessor fields are supported by
 // Map::ReconfigureProperty().
 
 
 // TODO(ishell): add respective tests for fast property removal case once
 // Map::ReconfigureProperty() supports that.
 
 #endif