[heap] Fix PagedNewSpace initialization

Whenever PagedNewSpace allocates a page, the page is added to the free
list. Preallocating pages on space initialization means the pages are
added to the free list before the map for free space is initialized.
Then, when allocating from the free list, a DCHECK fails
(free-list.cc:508).

This CL delays page preallocation until `EnsureCurrentCapacity` is
called. When using PagedNewSpace, we will call this method from
`Heap::CreateHeapObjects` after the maps are allocated and before any
allocations in new space are attempted.

Bug: v8:12612
Change-Id: I33f825ddd831640b12e4c0f7b849262a335df51e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3780541Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81919}

src/heap/new-spaces.cc

@@ -899,9 +899,10 @@ PagedSpaceForNewSpace::PagedSpaceForNewSpace(
       target_capacity_(initial_capacity_) {
   DCHECK_LE(initial_capacity_, max_capacity_);
 
-  // Preallocate pages for the initial capacity but don't allocate a linear
-  // allocation area yet.
-  CHECK(EnsureCurrentCapacity());
+  // Adding entries to the free list requires having a map for free space. Not
+  // preallocating pages yet because the map may not be available yet when the
+  // space is initialized. `EnsureCurrentCapacity()` should be called after maps
+  // are allocated to preallocate pages.
 }
 
 Page* PagedSpaceForNewSpace::InitializePage(MemoryChunk* chunk) {
@@ -985,6 +986,9 @@ bool PagedSpaceForNewSpace::AddFreshPage() {
 }
 
 bool PagedSpaceForNewSpace::EnsureCurrentCapacity() {
+  // Verify that the free space map is already initialized. Otherwise, new free
+  // list entries will be invalid.
+  DCHECK_NE(0, heap()->isolate()->root(RootIndex::kFreeSpaceMap).ptr());
   while (current_capacity_ < target_capacity_) {
     if (!TryExpandImpl()) return false;
   }

test/cctest/heap/test-spaces.cc

@@ -328,13 +328,18 @@ TEST(PagedNewSpace) {
       heap, CcTest::heap()->InitialSemiSpaceSize(),
       CcTest::heap()->InitialSemiSpaceSize(), allocation_info);
   CHECK(new_space->MaximumCapacity());
+  CHECK(new_space->EnsureCurrentCapacity());
+  CHECK_LT(0, new_space->TotalCapacity());
 
   AllocationResult allocation_result;
+  size_t successful_allocations = 0;
   while (!(allocation_result = new_space->AllocateRaw(kMaxRegularHeapObjectSize,
                                                       kTaggedAligned))
               .IsFailure()) {
+    successful_allocations++;
     CHECK(new_space->Contains(allocation_result.ToObjectChecked()));
   }
+  CHECK_LT(0, successful_allocations);
 
   new_space.reset();
   memory_allocator->unmapper()->EnsureUnmappingCompleted();