Fix pointer iteration for maps.

test/cctest/test-heap.cc

Index: test/cctest/test-heap.cc
diff --git a/test/cctest/test-heap.cc b/test/cctest/test-heap.cc
index ab000dc6a6ee28f1ebc78b491db3a630074e9b18..4a84e0f82b950c17e8e6bc9ee15c57a3fedf1963 100644
--- a/test/cctest/test-heap.cc
+++ b/test/cctest/test-heap.cc
@@ -4475,6 +4475,49 @@ TEST(Regress388880) {
 }
 
 
+TEST(RegressStoreBufferMapUpdate) {
+  CcTest::InitializeVM();
+  v8::HandleScope scope(CcTest::isolate());
+  Isolate* isolate = CcTest::i_isolate();
+  Factory* factory = isolate->factory();
+  Heap* heap = isolate->heap();
+
+  // This test checks that we do not treat instance size field of the map
+  // as a heap pointer (when processing store buffer).
+
+  Handle<Map> map1 = Map::Create(isolate->object_function(), 1);
+
+  // Allocate a throw-away object.
+  factory->NewFixedArray(1, NOT_TENURED);
+
+  // Allocate an object that will be moved by the GC (because the throw-away
+  // object will die).
+  Handle<FixedArray> obj_to_move = factory->NewFixedArray(1, NOT_TENURED);
+
+  // Record the address before the GC.
+  Object* obj_to_move_address = *obj_to_move;
+
+  // Smash the pointer to the moving object into the instance size field of
+  // the map.

[Hannes Payer (out of office), 2014/08/14 07:27:32]

Can you just add a bit more of information why we do that?

[Jarin, 2014/08/14 07:37:32]

Done. Better?

+  *(reinterpret_cast<Object**>(map1->address() + Map::kInstanceSizeOffset)) =
+      obj_to_move_address;
+
+  // Make sure we scan the map's page on scavenge.
+  Page* page = Page::FromAddress(map1->address());
+  page->set_scan_on_scavenge(true);
+
+  heap->CollectGarbage(NEW_SPACE);
+
+  // Check the object has really moved.
+  CHECK(*obj_to_move != obj_to_move_address);
+
+  // Now check that we have not updated the instance size field of the map.
+  CHECK_EQ(obj_to_move_address,
+           *(reinterpret_cast<Object**>(map1->address() +
+                                        Map::kInstanceSizeOffset)));
+}
+
+
 #ifdef DEBUG
 TEST(PathTracer) {
   CcTest::InitializeVM();