[heap] Don't consider mementos on pages below age mark

src/heap/heap-inl.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_HEAP_HEAP_INL_H_
 #define V8_HEAP_HEAP_INL_H_
 
 #include <cmath>
 
 #include "src/base/platform/platform.h"
@@ skipping 461 matching lines @@
   return false;
 }
 
 void Heap::CopyBlock(Address dst, Address src, int byte_size) {
   CopyWords(reinterpret_cast<Object**>(dst), reinterpret_cast<Object**>(src),
             static_cast<size_t>(byte_size / kPointerSize));
 }
 
 template <Heap::FindMementoMode mode>
 AllocationMemento* Heap::FindAllocationMemento(HeapObject* object) {
-  // Check if there is potentially a memento behind the object. If
-  // the last word of the memento is on another page we return
-  // immediately.
   Address object_address = object->address();
   Address memento_address = object_address + object->Size();
   Address last_memento_word_address = memento_address + kPointerSize;
-  if (!Page::OnSamePage(object_address, last_memento_word_address)) {
+  Page* object_page = Page::FromAddress(object_address);
+  // If the memento would be on another page, bail out immediately.
+  if ((object_page != Page::FromAddress(last_memento_word_address))) {

[Hannes Payer (out of office), 2016/07/27 08:34:34]

Can you leave the original check unchanged?

[Michael Lippautz, 2016/07/27 11:12:07]

Done.

     return nullptr;
   }
   HeapObject* candidate = HeapObject::FromAddress(memento_address);
   Map* candidate_map = candidate->map();
   // This fast check may peek at an uninitialized word. However, the slow check
   // below (memento_address == top) ensures that this is safe. Mark the word as
   // initialized to silence MemorySanitizer warnings.
   MSAN_MEMORY_IS_INITIALIZED(&candidate_map, sizeof(candidate_map));
   if (candidate_map != allocation_memento_map()) {
     return nullptr;
   }
+
+  // If the memento is below the age mark, which can happen when mementos
+  // survived because a page got moved within new space, bail out.
+  if (object_page->IsFlagSet(MemoryChunk::NEW_SPACE_BELOW_AGE_MARK)) {
+    return nullptr;
+  }
+
   AllocationMemento* memento_candidate = AllocationMemento::cast(candidate);
 
   // Depending on what the memento is used for, we might need to perform
   // additional checks.
   Address top;
   switch (mode) {
     case Heap::kForGC:
       return memento_candidate;
     case Heap::kForRuntime:
       if (memento_candidate == nullptr) return nullptr;
@@ skipping 252 matching lines @@
 
 void VerifySmisVisitor::VisitPointers(Object** start, Object** end) {
   for (Object** current = start; current < end; current++) {
     CHECK((*current)->IsSmi());
   }
 }
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_HEAP_HEAP_INL_H_