[data structures] Fix ZoneChunkList end iterator.

BUG=v8:7478

Change-Id: Iad67d49729dfeb89fde26772689a22098f491b8a
Reviewed-on: https://chromium-review.googlesource.com/931548
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51510}

src/zone/zone-chunk-list.h

@@ -211,7 +211,7 @@ class ZoneChunkListIterator {
 
     DCHECK_LE(list->back_->position_, list->back_->capacity_);
     if (list->back_->position_ == list->back_->capacity_) {
-      return ZoneChunkListIterator(nullptr, 0);
+      return ZoneChunkListIterator(list->back_->next_, 0);
     }
 
     return ZoneChunkListIterator(list->back_, list->back_->position_);

test/unittests/zone/zone-chunk-list-unittest.cc

@@ -227,5 +227,45 @@ TEST(ZoneChunkList, ConstForwardIterationTest) {
   TestForwardIterationOfConstList(zone_chunk_list);
 }
 
+TEST(ZoneChunkList, RewindAndIterate) {
+  // Regression test for https://bugs.chromium.org/p/v8/issues/detail?id=7478
+  AccountingAllocator allocator;
+  Zone zone(&allocator, ZONE_NAME);
+
+  ZoneChunkList<int> zone_chunk_list(&zone);
+
+  // Fill the list enough so that it will contain 2 chunks.
+  int chunk_size = static_cast<int>(ZoneChunkList<int>::StartMode::kSmall);
+  for (int i = 0; i < chunk_size + 1; ++i) {
+    zone_chunk_list.push_back(i);
+  }
+
+  // Rewind and fill the first chunk again.
+  zone_chunk_list.Rewind();
+  for (int i = 0; i < chunk_size; ++i) {
+    zone_chunk_list.push_back(i);
+  }
+
+  std::vector<int> expected;
+  for (int i = 0; i < chunk_size; ++i) {
+    expected.push_back(i);
+  }
+  std::vector<int> got;
+
+  // Iterate. This used to not yield the expected result, since the end iterator
+  // was in a weird state, and the running iterator didn't reach it after the
+  // first chunk.
+  auto it = zone_chunk_list.begin();
+  while (it != zone_chunk_list.end()) {
+    int value = *it;
+    got.push_back(value);
+    ++it;
+  }
+  CHECK_EQ(expected.size(), got.size());
+  for (size_t i = 0; i < expected.size(); ++i) {
+    CHECK_EQ(expected[i], got[i]);
+  }
+}
+
 }  // namespace internal
 }  // namespace v8