[heap-verify] Allow for temporary invalid array length for slow elements

src/objects-debug.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/objects.h"
 
 #include "src/bootstrapper.h"
 #include "src/disasm.h"
 #include "src/disassembler.h"
 #include "src/field-type.h"
@@ skipping 767 matching lines @@
   if (!length()->IsNumber()) return;
   // Verify that the length and the elements backing store are in sync.
   if (length()->IsSmi() && HasFastElements()) {
     int size = Smi::cast(length())->value();
     // Holey / Packed backing stores might have slack or might have not been
     // properly initialized yet.
     CHECK(size <= elements()->length() ||
           elements() == isolate->heap()->empty_fixed_array());
   } else {
     CHECK(HasDictionaryElements());
-    uint32_t size;
-    CHECK(length()->ToArrayLength(&size));
-    if (size != 0) {
+    uint32_t array_length;
+    CHECK(length()->ToArrayLength(&array_length));
+    if (array_length == 0xffffffff) {
+      CHECK(length()->ToArrayLength(&array_length));
+    }
+    if (array_length != 0) {
       SeededNumberDictionary* dict = SeededNumberDictionary::cast(elements());
-      // The dictionary can never have more elements than the array length.
-      CHECK(static_cast<uint32_t>(dict->NumberOfElements()) <= size);
+      // The dictionary can never have more elements than the array length + 1.
+      // If the backing store grows the verification might be triggered with
+      // the old length in place.
+      uint32_t nof_elements = static_cast<uint32_t>(dict->NumberOfElements());
+      if (nof_elements != 0) nof_elements--;
+      CHECK_LE(nof_elements, array_length);
     }
   }
 }
 
 
 void JSSet::JSSetVerify() {
   CHECK(IsJSSet());
   JSObjectVerify();
   VerifyHeapPointer(table());
   CHECK(table()->IsOrderedHashTable() || table()->IsUndefined(GetIsolate()));
@@ skipping 696 matching lines @@
 
   // Both are done at the same time.
   CHECK_EQ(new_it.done(), old_it.done());
 }
 
 
 #endif  // DEBUG
 
 }  // namespace internal
 }  // namespace v8