heap: Drop null references

Those references would be passed over to Blink via buffer and dropped
after a virtual call.

Bug: chromium:1056170
Change-Id: Idd02acce7a2d5c927dd9dc2415fe507b00ff3e58
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2682646
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72568}

src/heap/embedder-tracing.cc

@@ -111,7 +111,7 @@ void LocalEmbedderHeapTracer::ProcessingScope::TracePossibleWrapper(
 
   WrapperInfo info =
       LocalEmbedderHeapTracer::ExtractWrapperInfo(tracer_->isolate_, js_object);
-  if (VerboseWrapperInfo(info).is_valid()) {
+  if (!VerboseWrapperInfo(info).is_empty()) {
     wrapper_cache_.push_back(std::move(info));
   }
   FlushWrapperCacheIfFull();

src/heap/embedder-tracing.h

@@ -24,15 +24,16 @@ class V8_EXPORT_PRIVATE LocalEmbedderHeapTracer final {
   // internals in a named way. See ProcessingScope::TracePossibleJSWrapper()
   // below on how a V8 object is parsed to gather the information.
   struct VerboseWrapperInfo {
-    explicit VerboseWrapperInfo(const WrapperInfo& raw_info)
+    constexpr explicit VerboseWrapperInfo(const WrapperInfo& raw_info)
         : raw_info(raw_info) {}
 
     // Information describing the type pointed to via instance().
     void* type_info() const { return raw_info.first; }
     // Direct pointer to an instance described by type_info().
     void* instance() const { return raw_info.second; }
-
-    bool is_valid() const { return type_info(); }
+    // Returns whether the info is empty and thus does not keep a C++ object
+    // alive.
+    bool is_empty() const { return !type_info() || !instance(); }
 
     const WrapperInfo& raw_info;
   };

test/cctest/heap/test-embedder-tracing.cc

@@ -128,12 +128,12 @@ TEST(V8RegisteringEmbedderReference) {
   v8::Local<v8::Context> context = v8::Context::New(isolate);
   v8::Context::Scope context_scope(context);
 
-  void* first_field = reinterpret_cast<void*>(0x2);
-  v8::Local<v8::Object> api_object =
-      ConstructTraceableJSApiObject(context, first_field, nullptr);
+  void* first_and_second_field = reinterpret_cast<void*>(0x2);
+  v8::Local<v8::Object> api_object = ConstructTraceableJSApiObject(
+      context, first_and_second_field, first_and_second_field);
   CHECK(!api_object.IsEmpty());
   CcTest::CollectGarbage(i::OLD_SPACE);
-  CHECK(tracer.IsRegisteredFromV8(first_field));
+  CHECK(tracer.IsRegisteredFromV8(first_and_second_field));
 }
 
 TEST(EmbedderRegisteringV8Reference) {
@@ -182,11 +182,11 @@ TEST(TracingInRevivedSubgraph) {
   v8::Context::Scope context_scope(context);
 
   v8::Global<v8::Object> g;
-  void* first_field = reinterpret_cast<void*>(0x4);
+  void* first_and_second_field = reinterpret_cast<void*>(0x4);
   {
     v8::HandleScope inner_scope(isolate);
-    v8::Local<v8::Object> api_object =
-        ConstructTraceableJSApiObject(context, first_field, nullptr);
+    v8::Local<v8::Object> api_object = ConstructTraceableJSApiObject(
+        context, first_and_second_field, first_and_second_field);
     CHECK(!api_object.IsEmpty());
     v8::Local<v8::Object> o =
         v8::Local<v8::Object>::New(isolate, v8::Object::New(isolate));
@@ -195,7 +195,7 @@ TEST(TracingInRevivedSubgraph) {
     g.SetWeak(&g, ResurrectingFinalizer, v8::WeakCallbackType::kFinalizer);
   }
   CcTest::CollectGarbage(i::OLD_SPACE);
-  CHECK(tracer.IsRegisteredFromV8(first_field));
+  CHECK(tracer.IsRegisteredFromV8(first_and_second_field));
 }
 
 TEST(TracingInEphemerons) {
@@ -211,13 +211,13 @@ TEST(TracingInEphemerons) {
 
   v8::Local<v8::Object> key =
       v8::Local<v8::Object>::New(isolate, v8::Object::New(isolate));
-  void* first_field = reinterpret_cast<void*>(0x8);
+  void* first_and_second_field = reinterpret_cast<void*>(0x8);
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   Handle<JSWeakMap> weak_map = i_isolate->factory()->NewJSWeakMap();
   {
     v8::HandleScope inner_scope(isolate);
-    v8::Local<v8::Object> api_object =
-        ConstructTraceableJSApiObject(context, first_field, nullptr);
+    v8::Local<v8::Object> api_object = ConstructTraceableJSApiObject(
+        context, first_and_second_field, first_and_second_field);
     CHECK(!api_object.IsEmpty());
     Handle<JSObject> js_key =
         handle(JSObject::cast(*v8::Utils::OpenHandle(*key)), i_isolate);
@@ -226,7 +226,7 @@ TEST(TracingInEphemerons) {
     JSWeakCollection::Set(weak_map, js_key, js_api_object, hash);
   }
   CcTest::CollectGarbage(i::OLD_SPACE);
-  CHECK(tracer.IsRegisteredFromV8(first_field));
+  CHECK(tracer.IsRegisteredFromV8(first_and_second_field));
 }
 
 TEST(FinalizeTracingIsNoopWhenNotMarking) {