Fix free space repairing after deserialization.

src/heap/spaces.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/heap/spaces.h"
 
 #include <utility>
 
 #include "src/base/bits.h"
 #include "src/base/platform/platform.h"
@@ skipping 2821 matching lines @@
 // were created with the wrong FreeSpaceMap (normally NULL), so we need to
 // fix them.
 void PagedSpace::RepairFreeListsAfterDeserialization() {
   free_list_.RepairLists(heap());
   // Each page may have a small free space that is not tracked by a free list.
   // Update the maps for those free space objects.
   for (Page* page : *this) {
     size_t size = page->wasted_memory();
     if (size == 0) continue;
     DCHECK_GE(static_cast<size_t>(Page::kPageSize), size);
-    Address address = page->OffsetToAddress(Page::kPageSize - size);
+    Address address =

[Slava Chigrin, 2017/04/06 12:30:13]

I suppose here was a bug. As described here
https://cs.chromium.org/chromium/src/v8/src/heap/spaces.cc?gsn=AllocatePage&l...
Executable pages have a guard area at the end, that was not taken into account
at creating filler objects.

If I made a mistake, please, correct me.

[ulan, 2017/04/06 15:11:27]

We can use page->HighWaterMark() and page->area_end() which would be more
robust.

Could you please rewrite the code starting from line 2836 to something like:

  // Each page may have a small free space that is not tracked by a free list.
  // Those free spaces still contain null as their map pointer.
  // Overwrite them with new fillers.
  for (Page* page : *this) {
    int size = static_cast<int>(page->wasted_memory());
    if (size == 0) {
      // If there is no wasted memory then all free space is in the free list.
      continue;
    }
    Address start = page->HighWaterMark();
    Address end = page->area_end();
    CHECK_EQ(size, static_cast<int>(end - start));
    heap()->CreateFillerObjectAt(start, end, ClearRecordedSlots::kNo);
  }

[Slava Chigrin, 2017/04/06 15:48:34]

Done.

+        page->OffsetToAddress((page->executable() == EXECUTABLE
+                                   ? MemoryAllocator::CodePageAreaEndOffset()
+                                   : Page::kPageSize) -
+                              size);
+
     heap()->CreateFillerObjectAt(address, static_cast<int>(size),
                                  ClearRecordedSlots::kNo);
   }
 }
 
 HeapObject* PagedSpace::SweepAndRetryAllocation(int size_in_bytes) {
   MarkCompactCollector* collector = heap()->mark_compact_collector();
   if (collector->sweeping_in_progress()) {
     // Wait for the sweeper threads here and complete the sweeping phase.
     collector->EnsureSweepingCompleted();
@@ skipping 441 matching lines @@
     PrintF("\n");
   }
   printf(" --------------------------------------\n");
   printf(" Marked: %x, LiveCount: %" V8PRIdPTR "\n", mark_size,
          MarkingState::Internal(this).live_bytes());
 }
 
 #endif  // DEBUG
 }  // namespace internal
 }  // namespace v8