Workaround for gcc array bound check issue

src/heap/slot-set.h

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_SLOT_SET_H
 #define V8_SLOT_SET_H
 
 #include "src/allocation.h"
 #include "src/base/bits.h"
 #include "src/utils.h"
@@ skipping 54 matching lines @@
   // [page_start_ + start_offset ... page_start_ + end_offset).
   void RemoveRange(int start_offset, int end_offset) {
     CHECK_LE(end_offset, 1 << kPageSizeBits);
     DCHECK_LE(start_offset, end_offset);
     int start_bucket, start_cell, start_bit;
     SlotToIndices(start_offset, &start_bucket, &start_cell, &start_bit);
     int end_bucket, end_cell, end_bit;
     SlotToIndices(end_offset, &end_bucket, &end_cell, &end_bit);
     uint32_t start_mask = (1u << start_bit) - 1;
     uint32_t end_mask = ~((1u << end_bit) - 1);
-    if (start_bucket == end_bucket && start_cell == end_cell) {
+    if (start_bucket == end_bucket && start_cell == end_cell &&
+       start_bucket < kBuckets) {
       MaskCell(start_bucket, start_cell, start_mask | end_mask);

[Michael Lippautz, 2016/08/18 09:19:19]

I would guess that the access in MaskCell is the problem, right?

Can we move the condition in there? Maybe something like
  if (bucket < kBuckets) {
    // masking
  } else {
    // Explain the gcc bug.
    UNREACHABLE();
  }

       return;
     }
     int current_bucket = start_bucket;
     int current_cell = start_cell;
     MaskCell(current_bucket, current_cell, start_mask);
     current_cell++;
     if (current_bucket < end_bucket) {
       if (bucket[current_bucket] != nullptr) {
         while (current_cell < kCellsPerBucket) {
           bucket[current_bucket][current_cell] = 0;
           current_cell++;
         }
       }
       // The rest of the current bucket is cleared.
       // Move on to the next bucket.
       current_bucket++;
       current_cell = 0;
     }
     DCHECK(current_bucket == end_bucket ||
            (current_bucket < end_bucket && current_cell == 0));
     while (current_bucket < end_bucket) {
       ReleaseBucket(current_bucket);
       current_bucket++;
     }
     // All buckets between start_bucket and end_bucket are cleared.
     DCHECK(current_bucket == end_bucket && current_cell <= end_cell);
-    if (current_bucket == kBuckets || bucket[current_bucket] == nullptr) {
+    if (current_bucket == kBuckets || (current_bucket < kBuckets &&

[Michael Lippautz, 2016/08/18 09:19:19]

If you do above, then just add a comment that refers to MaskCell.

+       bucket[current_bucket] == nullptr)) {
       return;
     }
     while (current_cell < end_cell) {
       bucket[current_bucket][current_cell] = 0;
       current_cell++;
     }
     // All cells between start_cell and end_cell are cleared.
     DCHECK(current_bucket == end_bucket && current_cell == end_cell);
-    MaskCell(end_bucket, end_cell, end_mask);
+    if (end_bucket < kBuckets) {
+      MaskCell(end_bucket, end_cell, end_mask);
+    }
   }
 
   // The slot offset specifies a slot at address page_start_ + slot_offset.
   bool Lookup(int slot_offset) {
     int bucket_index, cell_index, bit_index;
     SlotToIndices(slot_offset, &bucket_index, &cell_index, &bit_index);
     if (bucket[bucket_index] != nullptr) {
       uint32_t cell = bucket[bucket_index][cell_index];
       return (cell & (1u << bit_index)) != 0;
     }
@@ skipping 226 matching lines @@
   };
 
   Address page_start_;
   Chunk* chunk_;
 };
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_SLOT_SET_H