[heap] Enforce explicit MarkingState

src/heap/array-buffer-tracker.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/heap/array-buffer-tracker.h"
 #include "src/heap/array-buffer-tracker-inl.h"
 #include "src/heap/heap.h"
 
 namespace v8 {
 namespace internal {
 
 LocalArrayBufferTracker::~LocalArrayBufferTracker() {
   CHECK(array_buffers_.empty());
 }
 
 template <LocalArrayBufferTracker::FreeMode free_mode>
 void LocalArrayBufferTracker::Free() {
   size_t freed_memory = 0;
   for (TrackingData::iterator it = array_buffers_.begin();
        it != array_buffers_.end();) {
     JSArrayBuffer* buffer = reinterpret_cast<JSArrayBuffer*>(it->first);
-    if ((free_mode == kFreeAll) || ObjectMarking::IsWhite(buffer)) {
+    // TODO(mlippautz): Create a dependency on the collector to avoid getting
+    // the marking state out of thin air.
+    if ((free_mode == kFreeAll) ||
+        ObjectMarking::IsWhite(buffer, MarkingState::Internal(buffer))) {
       const size_t len = it->second;
       heap_->isolate()->array_buffer_allocator()->Free(buffer->backing_store(),
                                                        len);
       freed_memory += len;
       it = array_buffers_.erase(it);
     } else {
       ++it;
     }
   }
   if (freed_memory > 0) {
@@ skipping 96 matching lines @@
   {
     base::LockGuard<base::Mutex> guard(page->mutex());
     LocalArrayBufferTracker* tracker = page->local_tracker();
     if (tracker == nullptr) return false;
     return tracker->IsTracked(buffer);
   }
 }
 
 }  // namespace internal
 }  // namespace v8