[heap] GCTracer: Fix UB when iterating incremental scopes

src/heap/gc-tracer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/heap/gc-tracer.h"
 
 #include "src/counters.h"
 #include "src/heap/heap-inl.h"
 #include "src/isolate.h"
 
@@ skipping 258 matching lines @@
     recorded_scavenges_survived_.Push(MakeBytesAndDuration(
         current_.survived_new_space_object_size, duration));
   } else if (current_.type == Event::INCREMENTAL_MARK_COMPACTOR) {
     MergeBaseline(previous_incremental_mark_compactor_event_);
     recorded_incremental_marking_steps_.Push(
         MakeBytesAndDuration(current_.incremental_marking_bytes,
                              current_.pure_incremental_marking_duration));
     recorded_incremental_mark_compacts_.Push(
         MakeBytesAndDuration(current_.start_object_size, duration));
     combined_mark_compact_speed_cache_ = 0.0;
-    for (int i = 0; i <= Scope::NUMBER_OF_INCREMENTAL_SCOPES; i++) {
+    for (int i = 0; i < Scope::NUMBER_OF_INCREMENTAL_SCOPES; i++) {
       incremental_marking_scopes_[i].ResetCurrentCycle();
     }
   } else {
     DCHECK(current_.incremental_marking_bytes == 0);
     DCHECK(current_.pure_incremental_marking_duration == 0);
     recorded_mark_compacts_.Push(
         MakeBytesAndDuration(current_.start_object_size, duration));
     combined_mark_compact_speed_cache_ = 0.0;
-    for (int i = 0; i <= Scope::NUMBER_OF_INCREMENTAL_SCOPES; i++) {
+    for (int i = 0; i < Scope::NUMBER_OF_INCREMENTAL_SCOPES; i++) {
       incremental_marking_scopes_[i].ResetCurrentCycle();
     }
   }
 
   double spent_in_mutator = Max(current_.start_time - previous_.end_time, 0.0);
   heap_->UpdateCumulativeGCStatistics(duration, spent_in_mutator,
                                       current_.scopes[Scope::MC_MARK]);
 
   if (current_.type == Event::SCAVENGER && FLAG_trace_gc_ignore_scavenger)
     return;
@@ skipping 517 matching lines @@
   return sum / recorded_survival_ratios_.Count();
 }
 
 bool GCTracer::SurvivalEventsRecorded() const {
   return recorded_survival_ratios_.Count() > 0;
 }
 
 void GCTracer::ResetSurvivalEvents() { recorded_survival_ratios_.Reset(); }
 }  // namespace internal
 }  // namespace v8