[heap] Fix ThinString scavenge

Instead of writing the forwarding pointer of this object and treating it like
an object that would survive on scavenge just write the actual string pointer
to the outer slot. As a consequence, the ThingString will not look like a live
object and is handled properly when pruning the external string table.

Bug: v8:8249
Test: test/cctest/heap/test-external-string-tracker.cc
Change-Id: I975900213e2e4b598f298c8f78b6c6047c9e6da4
Reviewed-on: https://chromium-review.googlesource.com/1252885Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56311}

src/heap/heap.cc

@@ -2001,12 +2001,7 @@ String* Heap::UpdateNewSpaceReferenceInExternalStringTableEntry(Heap* heap,
 
   // String is still reachable.
   String* new_string = String::cast(first_word.ToForwardingAddress());
-  String* original_string = reinterpret_cast<String*>(*p);
-  // The length of the original string is used to disambiguate the scenario
-  // of a ThingString being forwarded to an ExternalString (which already exists
-  // in the OLD space), and an ExternalString being forwarded to its promoted
-  // copy. See Scavenger::EvacuateThinString.
-  if (new_string->IsThinString() || original_string->length() == 0) {
+  if (new_string->IsThinString()) {
     // Filtering Thin strings out of the external string table.
     return nullptr;
   } else if (new_string->IsExternalString()) {

src/heap/scavenger-inl.h

@@ -281,16 +281,14 @@ SlotCallbackResult Scavenger::EvacuateThinString(Map* map, HeapObject** slot,
                                                  ThinString* object,
                                                  int object_size) {
   if (!is_incremental_marking_) {
-    // Loading actual is fine in a parallel setting since there is no write.
+    // The ThinString should die after Scavenge, so avoid writing the proper
+    // forwarding pointer and instead just signal the actual object as forwarded
+    // reference.
     String* actual = object->actual();
-    object->set_length(0);
-    *slot = actual;
-    // ThinStrings always refer to internalized strings, which are
-    // always in old space.
+    // ThinStrings always refer to internalized strings, which are always in old
+    // space.
     DCHECK(!Heap::InNewSpace(actual));
-    base::AsAtomicPointer::Release_Store(
-        reinterpret_cast<Map**>(object->address()),
-        MapWord::FromForwardingAddress(actual).ToMap());
+    *slot = actual;
     return REMOVE_SLOT;
   }