Make new space iterable when transitioning double array to objects

src/arm/codegen-arm.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 544 matching lines @@
 void ElementsTransitionGenerator::GenerateDoubleToObject(
     MacroAssembler* masm, AllocationSiteMode mode, Label* fail) {
   // ----------- S t a t e -------------
   //  -- r0    : value
   //  -- r1    : key
   //  -- r2    : receiver
   //  -- lr    : return address
   //  -- r3    : target map, scratch for subsequent call
   //  -- r4    : scratch (elements)
   // -----------------------------------
-  Label entry, loop, convert_hole, gc_required, only_change_map;
+  Label entry, loop, convert_hole, gc_required, gc_cleanup, only_change_map;
 
   if (mode == TRACK_ALLOCATION_SITE) {
     __ JumpIfJSArrayHasAllocationMemento(r2, r4, fail);
   }
 
   // Check for empty arrays, which only require a map transition and no changes
   // to the backing store.
   __ ldr(r4, FieldMemOperand(r2, JSObject::kElementsOffset));
   __ CompareRoot(r4, Heap::kEmptyFixedArrayRootIndex);
   __ b(eq, &only_change_map);
@@ skipping 21 matching lines @@
   __ add(r5, r3, Operand(r5, LSL, 1));
   __ LoadRoot(r9, Heap::kHeapNumberMapRootIndex);
   // Using offsetted addresses in r4 to fully take advantage of post-indexing.
   // r3: begin of destination FixedArray element fields, not tagged
   // r4: begin of source FixedDoubleArray element fields, not tagged, +4
   // r5: end of destination FixedArray, not tagged
   // r6: destination FixedArray
   // r9: heap number map
   __ b(&entry);
 
+  __ bind(&gc_cleanup);
+#ifdef VERIFY_HEAP
+  // Make sure new space is iterable if we are verifying the heap.
+  __ mov(r0, Operand(masm->isolate()->factory()->one_pointer_filler_map()));
+  __ str(r0, MemOperand(r3, 4, PostIndex));
+  __ cmp(r3, r5);
+  __ b(lt, &gc_cleanup);
+#endif
+
   // Call into runtime if GC is required.
   __ bind(&gc_required);
   __ Pop(r3, r2, r1, r0);
   __ pop(lr);
   __ b(fail);
 
   __ bind(&loop);
   __ ldr(r1, MemOperand(r4, 8, PostIndex));
   // r1: current element's upper 32 bit
   // r4: address of next element's upper 32 bit
   __ cmp(r1, Operand(kHoleNanUpper32));
   __ b(eq, &convert_hole);
 
   // Non-hole double, copy value into a heap number.
-  __ AllocateHeapNumber(r2, r0, lr, r9, &gc_required);
+  __ AllocateHeapNumber(r2, r0, lr, r9, &gc_cleanup);
   // r2: new heap number
   __ ldr(r0, MemOperand(r4, 12, NegOffset));
   __ Strd(r0, r1, FieldMemOperand(r2, HeapNumber::kValueOffset));
   __ mov(r0, r3);
   __ str(r2, MemOperand(r3, 4, PostIndex));
   __ RecordWrite(r6,
                  r0,
                  r2,
                  kLRHasBeenSaved,
                  kDontSaveFPRegs,
@@ skipping 279 matching lines @@
     patcher.masm()->add(r0, pc, Operand(-8));
     patcher.masm()->ldr(pc, MemOperand(pc, -4));
     patcher.masm()->emit_code_stub_address(stub);
   }
 }
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_ARM