Use just one to-space page for the promotion queue.

src/heap/heap.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_HEAP_HEAP_H_
 #define V8_HEAP_HEAP_H_
 
 #include <cmath>
 
 #include "src/allocation.h"
@@ skipping 384 matching lines @@
   // store buffer overflows again we can exempt the page from the store buffer
   // by rewinding to this point instead of having to search the store buffer.
   Object*** start_of_current_page_;
   // The current page we are scanning in the store buffer iterator.
   MemoryChunk* current_page_;
 };
 
 
 // A queue of objects promoted during scavenge. Each object is accompanied
 // by it's size to avoid dereferencing a map pointer for scanning.
+// The last page in to-space is used for the promotion queue. On conflict
+// during scavenge, the promotion queue is allocated externally and all
+// entries are copied to the external queue.
 class PromotionQueue {
  public:
   explicit PromotionQueue(Heap* heap)
       : front_(NULL),
         rear_(NULL),
         limit_(NULL),
         emergency_stack_(0),
         heap_(heap) {}
 
   void Initialize();
 
   void Destroy() {
     DCHECK(is_empty());
     delete emergency_stack_;
     emergency_stack_ = NULL;
   }
 
   Page* GetHeadPage() {
     return Page::FromAllocationTop(reinterpret_cast<Address>(rear_));
   }
 
   void SetNewLimit(Address limit) {
+    // If we are already using an emergency stack, we can ignore it.
+    if (emergency_stack_) return;
+
+    // If the limit is not on the same page, we can ignore it.
+    if (Page::FromAllocationTop(limit) != GetHeadPage()) return;
+
     limit_ = reinterpret_cast<intptr_t*>(limit);
 
     if (limit_ <= rear_) {
       return;
     }
 
     RelocateQueueHead();
   }
 
   bool IsBelowPromotionQueue(Address to_space_top) {
+    // If an emergency stack is used, the to-space address cannot interfere
+    // with the promotion queue.
+    if (emergency_stack_) return true;
+
     // If the given to-space top pointer and the head of the promotion queue
     // are not on the same page, then the to-space objects are below the
     // promotion queue.
     if (GetHeadPage() != Page::FromAddress(to_space_top)) {
       return true;
     }
     // If the to space top pointer is smaller or equal than the promotion
     // queue head, then the to-space objects are below the promotion queue.
     return reinterpret_cast<intptr_t*>(to_space_top) <= rear_;
   }
 
   bool is_empty() {
     return (front_ == rear_) &&
            (emergency_stack_ == NULL || emergency_stack_->length() == 0);
   }
 
   inline void insert(HeapObject* target, int size);
 
   void remove(HeapObject** target, int* size) {
     DCHECK(!is_empty());
     if (front_ == rear_) {
       Entry e = emergency_stack_->RemoveLast();
       *target = e.obj_;
       *size = e.size_;
       return;
     }
 
-    if (NewSpacePage::IsAtStart(reinterpret_cast<Address>(front_))) {
-      NewSpacePage* front_page =
-          NewSpacePage::FromAddress(reinterpret_cast<Address>(front_));
-      DCHECK(!front_page->prev_page()->is_anchor());
-      front_ = reinterpret_cast<intptr_t*>(front_page->prev_page()->area_end());
-    }
     *target = reinterpret_cast<HeapObject*>(*(--front_));
     *size = static_cast<int>(*(--front_));
     // Assert no underflow.
     SemiSpace::AssertValidRange(reinterpret_cast<Address>(rear_),
                                 reinterpret_cast<Address>(front_));
   }
 
  private:
   // The front of the queue is higher in the memory page chain than the rear.
   intptr_t* front_;
@@ skipping 2114 matching lines @@
   DisallowHeapAllocation no_allocation;  // i.e. no gc allowed.
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(PathTracer);
 };
 #endif  // DEBUG
 }
 }  // namespace v8::internal
 
 #endif  // V8_HEAP_HEAP_H_