[heap] Clear slots for map space when writing zap values

Pointer updating requires the all slots to be valid. If we write zap values in
the sweeper we need to filter out invalid slots before.

BUG=chromium:625748
LOG=N
R=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2122963002
Cr-Commit-Position: refs/heads/master@{#37538}

src/heap/remembered-set.cc

@@ -39,6 +39,19 @@ void RememberedSet<direction>::ClearInvalidSlots(Heap* heap) {
           });
     }
   }
+  if (Heap::ShouldZapGarbage()) {
+    // Need to filter invalid slots as we overwrite them with zap values in
+    // during sweeping which runs concurrently with pointer updating.
+    for (MemoryChunk* chunk : *heap->map_space()) {
+      SlotSet* slots = GetSlotSet(chunk);
+      if (slots != nullptr) {
+        slots->Iterate([heap, chunk](Address addr) {
+          Object** slot = reinterpret_cast<Object**>(addr);
+          return IsValidSlot(heap, chunk, slot) ? KEEP_SLOT : REMOVE_SLOT;
+        });
+      }
+    }
+  }
 }
 
 template <PointerDirection direction>