Record code slots that may point to evacuation candidate objects after deoptimizing them.

BUG=chromium:506811
LOG=n

Review URL: https://codereview.chromium.org/1225573002

Cr-Commit-Position: refs/heads/master@{#29466}

src/deoptimizer.cc

@@ -414,9 +414,11 @@ void Deoptimizer::DeoptimizeMarkedCodeForContext(Context* context) {
     PatchCodeForDeoptimization(isolate, codes[i]);
 
     // We might be in the middle of incremental marking with compaction.
-    // Ignore all slots that might have been recorded on the deoptimized code
-    // object.
-    isolate->heap()->mark_compact_collector()->RemoveObjectSlots(codes[i]);
+    // Ignore all slots that might have been recorded in the body of the
+    // deoptimized code object.
+    Code* code = codes[i];
+    isolate->heap()->mark_compact_collector()->RemoveObjectSlots(
+        code->instruction_start(), code->address() + code->Size());
   }
 }
 

src/heap/mark-compact.cc

@@ -3236,7 +3236,8 @@ void MarkCompactCollector::VerifyIsSlotInLiveObject(Address slot,
 }
 
 
-void MarkCompactCollector::RemoveObjectSlots(HeapObject* invalid_object) {
+void MarkCompactCollector::RemoveObjectSlots(Address start_slot,
+                                             Address end_slot) {
   // Remove entries by replacing them with an old-space slot containing a smi
   // that is located in an unmovable page.
   int npages = evacuation_candidates_.length();
@@ -3245,7 +3246,8 @@ void MarkCompactCollector::RemoveObjectSlots(HeapObject* invalid_object) {
     DCHECK(p->IsEvacuationCandidate() ||
            p->IsFlagSet(Page::RESCAN_ON_EVACUATION));
     if (p->IsEvacuationCandidate()) {
-      SlotsBuffer::RemoveObjectSlots(heap_, p->slots_buffer(), invalid_object);
+      SlotsBuffer::RemoveObjectSlots(heap_, p->slots_buffer(), start_slot,
+                                     end_slot);
     }
   }
 }
@@ -4502,7 +4504,7 @@ void SlotsBuffer::RemoveInvalidSlots(Heap* heap, SlotsBuffer* buffer) {
 
 
 void SlotsBuffer::RemoveObjectSlots(Heap* heap, SlotsBuffer* buffer,
-                                    HeapObject* invalid_object) {
+                                    Address start_slot, Address end_slot) {
   // Remove entries by replacing them with an old-space slot containing a smi
   // that is located in an unmovable page.
   const ObjectSlot kRemovedEntry = HeapObject::RawField(
@@ -4519,9 +4521,7 @@ void SlotsBuffer::RemoveObjectSlots(Heap* heap, SlotsBuffer* buffer,
       ObjectSlot slot = slots[slot_idx];
       if (!IsTypedSlot(slot)) {
         Address slot_address = reinterpret_cast<Address>(slot);
-        if (slot_address >= invalid_object->address() &&
-            slot_address <
-                (invalid_object->address() + invalid_object->Size())) {
+        if (slot_address >= start_slot && slot_address < end_slot) {
           slots[slot_idx] = kRemovedEntry;
           if (is_typed_slot) {
             slots[slot_idx - 1] = kRemovedEntry;

src/heap/mark-compact.h

@@ -418,9 +418,9 @@ class SlotsBuffer {
   // before sweeping when mark bits are still intact.
   static void RemoveInvalidSlots(Heap* heap, SlotsBuffer* buffer);
 
-  // Eliminate all slots that point to the given invalid_object.
+  // Eliminate all slots that are within the given address range.
   static void RemoveObjectSlots(Heap* heap, SlotsBuffer* buffer,
-                                HeapObject* invalid_object);
+                                Address start_slot, Address end_slot);
 
   // Ensures that there are no invalid slots in the chain of slots buffers.
   static void VerifySlots(Heap* heap, SlotsBuffer* buffer);
@@ -742,8 +742,8 @@ class MarkCompactCollector {
   void VerifyIsSlotInLiveObject(Address slot, HeapObject* object);
 
   // Removes all the slots in the slot buffers that are within the given
-  // invalid_object.
-  void RemoveObjectSlots(HeapObject* invalid_object);
+  // address range.
+  void RemoveObjectSlots(Address start_slot, Address end_slot);
 
  private:
   class SweeperTask;

test/cctest/test-heap.cc

@@ -6041,7 +6041,9 @@ TEST(SlotsBufferObjectSlotsRemoval) {
   buffer->Add(HeapObject::RawField(*array, FixedArray::kHeaderSize));
   DCHECK(reinterpret_cast<void*>(buffer->Get(0)) ==
          HeapObject::RawField(*array, FixedArray::kHeaderSize));
-  SlotsBuffer::RemoveObjectSlots(CcTest::i_isolate()->heap(), buffer, *array);
+  SlotsBuffer::RemoveObjectSlots(CcTest::i_isolate()->heap(), buffer,
+                                 array->address(),
+                                 array->address() + array->Size());
   DCHECK(reinterpret_cast<void*>(buffer->Get(0)) ==
          HeapObject::RawField(heap->empty_fixed_array(),
                               FixedArrayBase::kLengthOffset));
@@ -6054,7 +6056,9 @@ TEST(SlotsBufferObjectSlotsRemoval) {
          reinterpret_cast<Object**>(SlotsBuffer::EMBEDDED_OBJECT_SLOT));
   DCHECK(reinterpret_cast<void*>(buffer->Get(2)) ==
          HeapObject::RawField(*array, FixedArray::kHeaderSize));
-  SlotsBuffer::RemoveObjectSlots(CcTest::i_isolate()->heap(), buffer, *array);
+  SlotsBuffer::RemoveObjectSlots(CcTest::i_isolate()->heap(), buffer,
+                                 array->address(),
+                                 array->address() + array->Size());
   DCHECK(reinterpret_cast<void*>(buffer->Get(1)) ==
          HeapObject::RawField(heap->empty_fixed_array(),
                               FixedArrayBase::kLengthOffset));