Fix heap verifier for partially constructed arrays when allocation folding is off.

src/objects-debug.cc

Index: src/objects-debug.cc
diff --git a/src/objects-debug.cc b/src/objects-debug.cc
index 3716df1e87cf6069dce0ab83d7564aa150b02d97..ba122bdde43d76e7230c04659ac286cdcda73d02 100644
--- a/src/objects-debug.cc
+++ b/src/objects-debug.cc
@@ -330,10 +330,13 @@ void JSObject::JSObjectVerify() {
     }
   }
 
-  // TODO(hpayer): deal gracefully with partially constructed JSObjects, when
-  // allocation folding is turned off.
-  if (reinterpret_cast<Map*>(elements()) !=
-      GetHeap()->one_pointer_filler_map()) {
+  if ((!FLAG_use_gvn || !FLAG_use_allocation_folding) &&
+      (reinterpret_cast<Map*>(elements()) ==
+      GetHeap()->one_pointer_filler_map())) {
+    // A GC was caused while constructing this object. This can just happen when
+    // allocation folding is turned off. The elements pointer may point to a

[mvstanton, 2013/09/13 09:57:13]

cool but can you reverse the if, I don't really like "then" blocks that are
empty!

[Hannes Payer (out of office), 2013/09/13 11:30:27]

Done.

+    // filler map in that case.
+  } else {
     CHECK_EQ((map()->has_fast_smi_or_object_elements() ||
               (elements() == GetHeap()->empty_fixed_array())),
              (elements()->map() == GetHeap()->fixed_array_map() ||
@@ -683,10 +686,13 @@ void Code::VerifyEmbeddedMapsDependency() {
 void JSArray::JSArrayVerify() {
   JSObjectVerify();
   CHECK(length()->IsNumber() || length()->IsUndefined());
-  // TODO(hpayer): deal gracefully with partially constructed JSObjects, when
-  // allocation folding is turned off.
-  if (reinterpret_cast<Map*>(elements()) !=
-      GetHeap()->one_pointer_filler_map()) {
+  if ((!FLAG_use_gvn || !FLAG_use_allocation_folding) &&
+      (reinterpret_cast<Map*>(elements()) ==
+      GetHeap()->one_pointer_filler_map())) {
+    // A GC was caused while constructing this array. This can just happen when
+    // allocation folding is turned off. The elements pointer may point to a

[mvstanton, 2013/09/13 09:57:13]

same thing.

[Hannes Payer (out of office), 2013/09/13 11:30:27]

Done.

+    // filler map in that case.
+  } else {
     CHECK(elements()->IsUndefined() ||
           elements()->IsFixedArray() ||
           elements()->IsFixedDoubleArray());