Reland of [heap] Remove live weak cells from weak cell list when finalizing...

Reland of [heap] Remove live weak cells from weak cell list when finalizing incremental marking. (patchset #1 id:1 of https://codereview.chromium.org/1481383004/ )

Reason for revert:
Reland after fixing the potential root cause of the canary crasher.

Original issue's description:
> Revert of [heap] Remove live weak cells from weak cell list when finalizing incremental marking. (patchset #3 id:40001 of https://codereview.chromium.org/1474303002/ )
>
> Reason for revert:
> Still investigating bad canary.
>
> Original issue's description:
> > [heap] Remove live weak cells from weak cell list when finalizing incremental marking.
> >
> > BUG=chromium:548562
> > LOG=n
> >
> > Committed: https://crrev.com/6190c608c8f3ced0f00ff53965e115b78646cecd
> > Cr-Commit-Position: refs/heads/master@{#32372}
>
> TBR=ulan@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:548562
>
> Committed: https://crrev.com/72ae472ccc51ec304a66a8730c1fedbe265c16fa
> Cr-Commit-Position: refs/heads/master@{#32459}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:548562

Review URL: https://codereview.chromium.org/1491743003

Cr-Commit-Position: refs/heads/master@{#32503}

src/heap/incremental-marking.cc

@@ -647,6 +647,44 @@ void IncrementalMarking::MarkObjectGroups() {
 }
 
 
+void IncrementalMarking::ProcessWeakCells() {
+  DCHECK(FLAG_finalize_marking_incrementally);
+  DCHECK(!finalize_marking_completed_);
+  DCHECK(IsMarking());
+
+  Object* weak_cell_obj = heap()->encountered_weak_cells();
+  Object* weak_cell_head = Smi::FromInt(0);
+  WeakCell* prev_weak_cell_obj = NULL;
+  while (weak_cell_obj != Smi::FromInt(0)) {
+    WeakCell* weak_cell = reinterpret_cast<WeakCell*>(weak_cell_obj);
+    // We do not insert cleared weak cells into the list, so the value
+    // cannot be a Smi here.
+    HeapObject* value = HeapObject::cast(weak_cell->value());
+    // Remove weak cells with live objects from the list, they do not need
+    // clearing.
+    if (MarkCompactCollector::IsMarked(value)) {
+      // Record slot, if value is pointing to an evacuation candidate.
+      Object** slot = HeapObject::RawField(weak_cell, WeakCell::kValueOffset);
+      heap_->mark_compact_collector()->RecordSlot(weak_cell, slot, *slot);
+      // Remove entry somewhere after top.
+      if (prev_weak_cell_obj != NULL) {
+        prev_weak_cell_obj->set_next(weak_cell->next());
+      }
+      weak_cell_obj = weak_cell->next();
+      weak_cell->clear_next(heap());
+    } else {
+      if (weak_cell_head == Smi::FromInt(0)) {
+        weak_cell_head = weak_cell;
+      }
+      prev_weak_cell_obj = weak_cell;
+      weak_cell_obj = weak_cell->next();
+    }
+  }
+  // Top may have changed.
+  heap()->set_encountered_weak_cells(weak_cell_head);
+}
+
+
 void IncrementalMarking::FinalizeIncrementally() {
   DCHECK(FLAG_finalize_marking_incrementally);
   DCHECK(!finalize_marking_completed_);
@@ -659,8 +697,11 @@ void IncrementalMarking::FinalizeIncrementally() {
   // objects to reduce the marking load in the final pause.
   // 1) We scan and mark the roots again to find all changes to the root set.
   // 2) We mark the object groups.
+  // 3) Remove weak cell with live values from the list of weak cells, they
+  // do not need processing during GC.
   MarkRoots();
   MarkObjectGroups();
+  ProcessWeakCells();
 
   int marking_progress =
       abs(old_marking_deque_top -

src/heap/incremental-marking.h

@@ -240,6 +240,7 @@ class IncrementalMarking {
 
   void MarkRoots();
   void MarkObjectGroups();
+  void ProcessWeakCells();
 
   void ActivateIncrementalWriteBarrier(PagedSpace* space);
   static void ActivateIncrementalWriteBarrier(NewSpace* space);