Avoid stale store buffer entries after full GC by promoting objects referenced by the store buffer.

src/heap/store-buffer.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <algorithm>
 
 #include "src/v8.h"
 
 #include "src/base/atomicops.h"
 #include "src/counters.h"
@@ skipping 363 matching lines @@
   if (FLAG_verify_heap) {
     Verify();
   }
 #endif
 }
 
 
 void StoreBuffer::ProcessOldToNewSlot(Address slot_address,
                                       ObjectSlotCallback slot_callback,
                                       bool clear_maps) {
+  printf("process %p\n", slot_address);
   Object** slot = reinterpret_cast<Object**>(slot_address);
   Object* object = reinterpret_cast<Object*>(
       base::NoBarrier_Load(reinterpret_cast<base::AtomicWord*>(slot)));
 
   // If the object is not in from space, it must be a duplicate store buffer
   // entry and the slot was already updated.
   if (heap_->InFromSpace(object)) {
     HeapObject* heap_object = reinterpret_cast<HeapObject*>(object);
     DCHECK(heap_object->IsHeapObject());
     // The new space object was not promoted if it still contains a map
     // pointer. Clear the map field now lazily (during full GC).
     if (clear_maps) ClearDeadObject(heap_object);
     slot_callback(reinterpret_cast<HeapObject**>(slot), heap_object);
     object = reinterpret_cast<Object*>(
         base::NoBarrier_Load(reinterpret_cast<base::AtomicWord*>(slot)));
     // If the object was in from space before and is after executing the
     // callback in to space, the object is still live.
     // Unfortunately, we do not know about the slot. It could be in a
     // just freed free space object.
     if (heap_->InToSpace(object)) {
+      printf("enter directly  %p\n", slot);
       EnterDirectlyIntoStoreBuffer(reinterpret_cast<Address>(slot));
     }
   }
 }
 
 
 void StoreBuffer::FindPointersToNewSpaceInRegion(
     Address start, Address end, ObjectSlotCallback slot_callback,
     bool clear_maps) {
   for (Address slot_address = start; slot_address < end;
@@ skipping 198 matching lines @@
     }
     old_buffer_is_sorted_ = false;
     old_buffer_is_filtered_ = false;
     *old_top_++ = reinterpret_cast<Address>(int_addr << kPointerSizeLog2);
     DCHECK(old_top_ <= old_limit_);
   }
   heap_->isolate()->counters()->store_buffer_compactions()->Increment();
 }
 }
 }  // namespace v8::internal