Fix rare access violation during JS heap serialization.

src/serialize.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
 #include "src/api.h"
 #include "src/base/platform/platform.h"
 #include "src/bootstrapper.h"
@@ skipping 1521 matching lines @@
       int root_index = serializer_->RootIndex(current_contents, kPlain);
       // Repeats are not subject to the write barrier so there are only some
       // objects that can be used in a repeat encoding.  These are the early
       // ones in the root array that are never in new space.
       if (current != start &&
           root_index != kInvalidRootIndex &&
           root_index < kRootArrayNumberOfConstantEncodings &&
           current_contents == current[-1]) {
         DCHECK(!serializer_->isolate()->heap()->InNewSpace(current_contents));
         int repeat_count = 1;
-        while (current < end - 1 && current[repeat_count] == current_contents) {
+        while (&current[repeat_count] < end - 1 &&
+            current[repeat_count] == current_contents) {
           repeat_count++;
         }

[Slava Chigrin, 2014/08/27 17:06:01]

Before that sometimes current[repeat_count] can go beyound |end| pointer and
cause access violation if current object placed at the end of page.

         current += repeat_count;
         bytes_processed_so_far_ += repeat_count * kPointerSize;
         if (repeat_count > kMaxRepeats) {
           sink_->Put(kRepeat, "SerializeRepeats");
           sink_->PutInt(repeat_count, "SerializeRepeats");
         } else {
           sink_->Put(CodeForRepeats(repeat_count), "SerializeRepeats");
         }
       } else {
         serializer_->SerializeObject(
@@ skipping 401 matching lines @@
 
 int SerializedCodeData::CheckSum(String* string) {
   int checksum = Version::Hash();
 #ifdef DEBUG
   uint32_t seed = static_cast<uint32_t>(checksum);
   checksum = static_cast<int>(IteratingStringHasher::Hash(string, seed));
 #endif  // DEBUG
   return checksum;
 }
 } }  // namespace v8::internal