[heap] Fix retaining path reporting for JS weak collections.

The link between the JS weak collection object and its backing store
was missing.

Change-Id: If8293a8d43fb52bc4fc9f156ccda578233a1991c
Reviewed-on: https://chromium-review.googlesource.com/579267Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46787}

src/heap/incremental-marking.cc

@@ -316,7 +316,7 @@ class IncrementalMarkingMarkingVisitor final
 
   // Marks the object black without pushing it on the marking stack.
   // Returns true if object needed marking and false otherwise.
-  V8_INLINE bool MarkObjectWithoutPush(Object* obj) {
+  V8_INLINE bool MarkObjectWithoutPush(HeapObject* host, Object* obj) {
     HeapObject* heap_object = HeapObject::cast(obj);
     return ObjectMarking::WhiteToBlack<IncrementalMarking::kAtomicity>(
         heap_object, incremental_marking_->marking_state(heap_object));

src/heap/mark-compact.cc

@@ -1070,8 +1070,14 @@ class MarkCompactMarkingVisitor final
 
   // Marks the object black without pushing it on the marking stack. Returns
   // true if object needed marking and false otherwise.
-  V8_INLINE bool MarkObjectWithoutPush(HeapObject* object) {
-    return ObjectMarking::WhiteToBlack(object, MarkingState::Internal(object));
+  V8_INLINE bool MarkObjectWithoutPush(HeapObject* host, HeapObject* object) {
+    if (ObjectMarking::WhiteToBlack(object, MarkingState::Internal(object))) {
+      if (V8_UNLIKELY(FLAG_track_retaining_path)) {
+        heap_->AddRetainer(host, object);
+      }
+      return true;
+    }
+    return false;
   }
 
   V8_INLINE void MarkObjectByPointer(HeapObject* host, Object** p) {

src/heap/objects-visiting-inl.h

@@ -273,7 +273,7 @@ int MarkingVisitor<ConcreteVisitor>::VisitJSWeakCollection(
       HeapObject::RawField(weak_collection, JSWeakCollection::kTableOffset);
   HeapObject* obj = HeapObject::cast(*slot);
   collector_->RecordSlot(weak_collection, slot, obj);
-  visitor->MarkObjectWithoutPush(obj);
+  visitor->MarkObjectWithoutPush(weak_collection, obj);
   return size;
 }
 
@@ -321,10 +321,7 @@ void MarkingVisitor<ConcreteVisitor>::MarkMapContents(Map* map) {
   // just mark the entire descriptor array.
   if (!map->is_prototype_map()) {
     DescriptorArray* descriptors = map->instance_descriptors();
-    if (V8_UNLIKELY(FLAG_track_retaining_path)) {
-      heap_->AddRetainer(map, descriptors);
-    }
-    if (visitor->MarkObjectWithoutPush(descriptors) &&
+    if (visitor->MarkObjectWithoutPush(map, descriptors) &&
         descriptors->length() > 0) {
       visitor->VisitPointers(descriptors, descriptors->GetFirstElementAddress(),
                              descriptors->GetDescriptorEndSlot(0));