[heap] RemoveRange of SlotSet should not push nullptr for empty buckets on the pre-free stack.

src/heap/slot-set.h

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_SLOT_SET_H
 #define V8_SLOT_SET_H
 
 #include <stack>
 
 #include "src/allocation.h"
@@ skipping 63 matching lines @@
       if (cell) {
         uint32_t bit_mask = 1u << bit_index;
         if (cell & bit_mask) {
           current_bucket[cell_index].ClearBit(bit_index);
         }
       }
     }
   }
 
   void PreFreeEmptyBucket(int bucket_index) {
-    base::LockGuard<base::Mutex> guard(&to_be_freed_buckets_mutex_);
     base::AtomicValue<uint32_t>* bucket_ptr = bucket[bucket_index].Value();
-    to_be_freed_buckets_.push(bucket_ptr);
-    bucket[bucket_index].SetValue(nullptr);
+    if (bucket_ptr != nullptr) {
+      base::LockGuard<base::Mutex> guard(&to_be_freed_buckets_mutex_);
+      to_be_freed_buckets_.push(bucket_ptr);
+      bucket[bucket_index].SetValue(nullptr);
+    }
   }
 
   // The slot offsets specify a range of slots at addresses:
   // [page_start_ + start_offset ... page_start_ + end_offset).
   void RemoveRange(int start_offset, int end_offset, EmptyBucketMode mode) {
     CHECK_LE(end_offset, 1 << kPageSizeBits);
     DCHECK_LE(start_offset, end_offset);
     int start_bucket, start_cell, start_bit;
     SlotToIndices(start_offset, &start_bucket, &start_cell, &start_bit);
     int end_bucket, end_cell, end_bit;
@@ skipping 383 matching lines @@
   Address page_start_;
   base::AtomicValue<Chunk*> chunk_;
   base::Mutex to_be_freed_chunks_mutex_;
   std::stack<Chunk*> to_be_freed_chunks_;
 };
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_SLOT_SET_H