Fix Object::Clone heap corruption under concurrent sweeping.

runtime/vm/object.cc

Index: runtime/vm/object.cc
===================================================================
--- runtime/vm/object.cc	(revision 40915)
+++ runtime/vm/object.cc	(working copy)
@@ -1745,7 +1745,15 @@
   intptr_t size = src.raw()->Size();
   RawObject* raw_obj = Object::Allocate(cls.id(), size, space);
   NoGCScope no_gc;
+  // Newly allocated objects are white ...
+  // TODO(koda): This will trip when we start allocating black.
+  // Update unmarking code below at that point.
+  ASSERT(!raw_obj->IsMarked());
   memmove(raw_obj->ptr(), src.raw()->ptr(), size);
+  // ... so ensure clone is too (see issue 21236).
+  if (raw_obj->IsMarked()) {
+    raw_obj->ClearMarkBit();
+  }
   if ((space == Heap::kOld) && !raw_obj->IsRemembered()) {

[Ivan Posva, 2014/10/06 05:18:53]

We should discuss this condition in person. I am not convinced this is correct.

[koda, 2014/10/06 05:35:35]

Agreed.

In general, this method seems awfully tricky to get right, considering new tags
might be added. We should go over all its uses to see whether it can be replaced
with something safer.

I will also add a check to --verify_before_gc that no objects are marked.

     StoreBufferUpdateVisitor visitor(Isolate::Current(), raw_obj);
     raw_obj->VisitPointers(&visitor);