[heap] Fix code that assumes monotonicity of PromotedSpaceSizeOfObjects.

After dfc6b4dd the space size can decrease if the sweeper discovers
new fillers added after marking (e.g. by array trimming).

Bug: chromium:756832
Change-Id: Ibf420593bd12a4fe13a1e47f862302025b52ad58
Reviewed-on: https://chromium-review.googlesource.com/620734Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47431}

src/heap/heap.cc

@@ -1910,9 +1910,6 @@ void Heap::Scavenge() {
   // Implements Cheney's copying algorithm
   LOG(isolate_, ResourceEvent("scavenge", "begin"));
 
-  // Used for updating survived_since_last_expansion_ at function end.
-  size_t survived_watermark = PromotedSpaceSizeOfObjects();
-
   // Flip the semispaces.  After flipping, to space is empty, from space has
   // live objects.
   new_space_->Flip();
@@ -1998,9 +1995,7 @@ void Heap::Scavenge() {
   });
 
   // Update how much has survived scavenge.
-  DCHECK_GE(PromotedSpaceSizeOfObjects(), survived_watermark);
-  IncrementYoungSurvivorsCounter(PromotedSpaceSizeOfObjects() +
-                                 new_space_->Size() - survived_watermark);
+  IncrementYoungSurvivorsCounter(SurvivedNewSpaceObjectSize());
 
   // Scavenger may find new wrappers by iterating objects promoted onto a black
   // page.

src/heap/heap.h

@@ -1407,7 +1407,13 @@ class Heap {
   }
 
   size_t PromotedSinceLastGC() {
-    return PromotedSpaceSizeOfObjects() - old_generation_size_at_last_gc_;
+    size_t old_generation_size = PromotedSpaceSizeOfObjects();
+    if (old_generation_size < old_generation_size_at_last_gc_) {
+      // This can happen if the promoted space size was refined in the
+      // sweeper after mutator doing array trimming.
+      return 0;
+    }
+    return old_generation_size - old_generation_size_at_last_gc_;
   }
 
   int gc_count() const { return gc_count_; }