[heap] Correctly handle strings in concurrent marking.

String with pointers should use snapshotting protocol because they can
be externalized concurrently.

Sequential strings can be turned into thin strings, so we need to cache
the length and synchronized of markbits.

No-Try: true
Bug: v8:6915, chromium:694255
Change-Id: Ibd1f0ead31544f56aa9de9a177bee7e60fbc2e6a
Reviewed-on: https://chromium-review.googlesource.com/708761
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48432}

src/heap/concurrent-marking.cc

@@ -133,6 +133,52 @@ class ConcurrentMarkingVisitor final
     return 0;
   }
 
+  // ===========================================================================
+  // Strings with pointers =====================================================
+  // ===========================================================================
+
+  int VisitConsString(Map* map, ConsString* object) {
+    int size = ConsString::BodyDescriptor::SizeOf(map, object);
+    const SlotSnapshot& snapshot = MakeSlotSnapshot(map, object, size);
+    if (!ShouldVisit(object)) return 0;
+    VisitPointersInSnapshot(object, snapshot);
+    return size;
+  }
+
+  int VisitSlicedString(Map* map, SlicedString* object) {
+    int size = SlicedString::BodyDescriptor::SizeOf(map, object);
+    const SlotSnapshot& snapshot = MakeSlotSnapshot(map, object, size);
+    if (!ShouldVisit(object)) return 0;
+    VisitPointersInSnapshot(object, snapshot);
+    return size;
+  }
+
+  int VisitThinString(Map* map, ThinString* object) {
+    int size = ThinString::BodyDescriptor::SizeOf(map, object);
+    const SlotSnapshot& snapshot = MakeSlotSnapshot(map, object, size);
+    if (!ShouldVisit(object)) return 0;
+    VisitPointersInSnapshot(object, snapshot);
+    return size;
+  }
+
+  // ===========================================================================
+  // Strings without pointers ==================================================
+  // ===========================================================================
+
+  int VisitSeqOneByteString(Map* map, SeqOneByteString* object) {
+    int size = SeqOneByteString::SizeFor(object->synchronized_length());
+    if (!ShouldVisit(object)) return 0;
+    VisitMapPointer(object, object->map_slot());
+    return size;
+  }
+
+  int VisitSeqTwoByteString(Map* map, SeqTwoByteString* object) {
+    int size = SeqTwoByteString::SizeFor(object->synchronized_length());
+    if (!ShouldVisit(object)) return 0;
+    VisitMapPointer(object, object->map_slot());
+    return size;
+  }
+
   // ===========================================================================
   // Fixed array object ========================================================
   // ===========================================================================
@@ -284,13 +330,14 @@ class ConcurrentMarkingVisitor final
     SlotSnapshot* slot_snapshot_;
   };
 
-  const SlotSnapshot& MakeSlotSnapshot(Map* map, HeapObject* object, int size) {
+  template <typename T>
+  const SlotSnapshot& MakeSlotSnapshot(Map* map, T* object, int size) {
     // TODO(ulan): Iterate only the existing fields and skip slack at the end
     // of the object.
     SlotSnapshottingVisitor visitor(&slot_snapshot_);
     visitor.VisitPointer(object,
                          reinterpret_cast<Object**>(object->map_slot()));
-    JSObject::BodyDescriptor::IterateBody(object, size, &visitor);
+    T::BodyDescriptor::IterateBody(object, size, &visitor);
     return slot_snapshot_;
   }
   ConcurrentMarking::MarkingWorklist::View shared_;