Fix bug in semispace shrink-to.

src/spaces.cc

Index: src/spaces.cc
diff --git a/src/spaces.cc b/src/spaces.cc
index 1d980cc05d2bd9077d531fabbe1b32420e3ed3ad..b75a43ec9341d024a298871a315b18e9a5ade8d2 100644
--- a/src/spaces.cc
+++ b/src/spaces.cc
@@ -1222,18 +1222,21 @@ bool SemiSpace::ShrinkTo(int new_capacity) {
   ASSERT((new_capacity & Page::kPageAlignmentMask) == 0);
   ASSERT(new_capacity >= initial_capacity_);
   ASSERT(new_capacity < capacity_);
-  Address end = start_ + maximum_capacity_;
-  Address start = end - new_capacity;
+  // Semispaces grow backwards from the end of their allocated capacity,
+  // so we find the before and after start addresses relative to the
+  // end of the space.
+  Address space_end = start_ + maximum_capacity_;
+  Address old_start = space_end - capacity_;
   size_t delta = capacity_ - new_capacity;
   ASSERT(IsAligned(delta, OS::AllocateAlignment()));
-  if (!heap()->isolate()->memory_allocator()->UncommitBlock(start, delta)) {
+  if (!heap()->isolate()->memory_allocator()->UncommitBlock(old_start, delta)) {
     return false;
   }
   capacity_ = new_capacity;
 
   int pages_after = capacity_ / Page::kPageSize;
   NewSpacePage* new_last_page =
-      NewSpacePage::FromAddress(end - pages_after * Page::kPageSize);
+      NewSpacePage::FromAddress(space_end - pages_after * Page::kPageSize);
   new_last_page->set_next_page(anchor());
   anchor()->set_prev_page(new_last_page);
   ASSERT(current_page_ == first_page());