[heap] Clear slots for map space when writing zap values

src/heap/remembered-set.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/heap/remembered-set.h"
 #include "src/heap/heap-inl.h"
 #include "src/heap/heap.h"
 #include "src/heap/mark-compact.h"
 #include "src/heap/slot-set.h"
 #include "src/heap/spaces.h"
@@ skipping 21 matching lines @@
       slots->Iterate(
           [heap, chunk](SlotType type, Address host_addr, Address addr) {
             if (Marking::IsBlack(Marking::MarkBitFrom(host_addr))) {
               return KEEP_SLOT;
             } else {
               return REMOVE_SLOT;
             }
           });
     }
   }
+  if (Heap::ShouldZapGarbage()) {
+    // Need to filter invalid slots as we overwrite them with zap values in
+    // during sweeping which runs concurrently with pointer updating.
+    for (MemoryChunk* chunk : *heap->map_space()) {
+      SlotSet* slots = GetSlotSet(chunk);
+      if (slots != nullptr) {
+        slots->Iterate([heap, chunk](Address addr) {
+          Object** slot = reinterpret_cast<Object**>(addr);
+          return IsValidSlot(heap, chunk, slot) ? KEEP_SLOT : REMOVE_SLOT;
+        });
+      }
+    }
+  }
 }
 
 template <PointerDirection direction>
 void RememberedSet<direction>::VerifyValidSlots(Heap* heap) {
   Iterate(heap, [heap](Address addr) {
     HeapObject* obj =
         heap->mark_compact_collector()->FindBlackObjectBySlotSlow(addr);
     if (obj == nullptr) {
       // The slot is in dead object.
       MemoryChunk* chunk = MemoryChunk::FromAnyPointerAddress(heap, addr);
@@ skipping 27 matching lines @@
          heap->mark_compact_collector()->IsSlotInBlackObject(
              chunk, reinterpret_cast<Address>(slot));
 }
 
 template void RememberedSet<OLD_TO_NEW>::ClearInvalidSlots(Heap* heap);
 template void RememberedSet<OLD_TO_NEW>::VerifyValidSlots(Heap* heap);
 template void RememberedSet<OLD_TO_OLD>::VerifyValidSlots(Heap* heap);
 
 }  // namespace internal
 }  // namespace v8