[heap] Fix off-by-one cell read in verification methods

src/heap/marking.h

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_MARKING_H
 #define V8_MARKING_H
 
 #include "src/base/atomic-utils.h"
 #include "src/utils.h"
 
@@ skipping 209 matching lines @@
     MarkBit::CellType matching_mask;
     if (start_cell_index != end_cell_index) {
       matching_mask = ~(start_index_mask - 1);
       if ((cells()[start_cell_index] & matching_mask) != matching_mask) {
         return false;
       }
       for (unsigned int i = start_cell_index + 1; i < end_cell_index; i++) {
         if (cells()[i] != ~0u) return false;
       }
       matching_mask = (end_index_mask - 1);
-      return ((cells()[end_cell_index] & matching_mask) == matching_mask);
+      // Check against a mask of 0 to avoid dereferencing the cell after the
+      // end of the bitmap.
+      return (matching_mask == 0) ||
+             ((cells()[end_cell_index] & matching_mask) == matching_mask);
     } else {
       matching_mask = end_index_mask - start_index_mask;
-      return (cells()[end_cell_index] & matching_mask) == matching_mask;
+      // Check against a mask of 0 to avoid dereferencing the cell after the
+      // end of the bitmap.
+      return (matching_mask == 0) ||
+             (cells()[end_cell_index] & matching_mask) == matching_mask;
     }
   }
 
   // Returns true if all bits in the range [start_index, end_index) are cleared.
   bool AllBitsClearInRange(uint32_t start_index, uint32_t end_index) {
     unsigned int start_cell_index = start_index >> Bitmap::kBitsPerCellLog2;
     MarkBit::CellType start_index_mask = 1u << Bitmap::IndexInCell(start_index);
 
     unsigned int end_cell_index = end_index >> Bitmap::kBitsPerCellLog2;
     MarkBit::CellType end_index_mask = 1u << Bitmap::IndexInCell(end_index);
 
     MarkBit::CellType matching_mask;
     if (start_cell_index != end_cell_index) {
       matching_mask = ~(start_index_mask - 1);
       if ((cells()[start_cell_index] & matching_mask)) return false;
       for (unsigned int i = start_cell_index + 1; i < end_cell_index; i++) {
         if (cells()[i]) return false;
       }
       matching_mask = (end_index_mask - 1);
-      return !(cells()[end_cell_index] & matching_mask);
+      // Check against a mask of 0 to avoid dereferencing the cell after the
+      // end of the bitmap.
+      return (matching_mask == 0) || !(cells()[end_cell_index] & matching_mask);
     } else {
       matching_mask = end_index_mask - start_index_mask;
-      return !(cells()[end_cell_index] & matching_mask);
+      // Check against a mask of 0 to avoid dereferencing the cell after the
+      // end of the bitmap.
+      return (matching_mask == 0) || !(cells()[end_cell_index] & matching_mask);
     }
   }
 
   static void PrintWord(uint32_t word, uint32_t himask = 0) {
     for (uint32_t mask = 1; mask != 0; mask <<= 1) {
       if ((mask & himask) != 0) PrintF("[");
       PrintF((mask & word) ? "1" : "0");
       if ((mask & himask) != 0) PrintF("]");
     }
   }
@@ skipping 185 matching lines @@
   }
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(Marking);
 };
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_MARKING_H_