cppgc: Add regression test for bug v8:10989

Bug: v8:10989
Change-Id: Ifccaec87661894c25b3078ace612b7ce02e9f6a6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2454069
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70361}

test/unittests/heap/cppgc/marking-verifier-unittest.cc

@@ -98,6 +98,48 @@ TEST_F(MarkingVerifierTest, DoesntDieOnInConstructionOnObject) {
       });
 }
 
+namespace {
+class GCedWithCallbackAndChild final
+    : public GarbageCollected<GCedWithCallbackAndChild> {
+ public:
+  template <typename Callback>
+  GCedWithCallbackAndChild(GCed* gced, Callback callback) : child_(gced) {
+    callback(this);
+  }
+  void Trace(cppgc::Visitor* visitor) const { visitor->Trace(child_); }
+
+ private:
+  Member<GCed> child_;
+};
+
+template <typename T>
+struct Holder : public GarbageCollected<Holder<T>> {
+ public:
+  void Trace(cppgc::Visitor* visitor) const { visitor->Trace(object); }
+  Member<T> object = nullptr;
+};
+}  // namespace
+
+TEST_F(MarkingVerifierTest, DoesntDieOnInConstructionObjectWithWriteBarrier) {
+  // Regression test: https://bugs.chromium.org/p/v8/issues/detail?id=10989.
+  // GCedWithCallbackAndChild is marked by write barrier and then discarded by
+  // FlushNotFullyConstructedObjects because it is already marked. This test
+  Persistent<Holder<GCedWithCallbackAndChild>> persistent =
+      MakeGarbageCollected<Holder<GCedWithCallbackAndChild>>(
+          GetAllocationHandle());
+  GarbageCollector::Config config =
+      GarbageCollector::Config::PreciseIncrementalConfig();
+  Heap::From(GetHeap())->StartIncrementalGarbageCollection(config);
+  MakeGarbageCollected<GCedWithCallbackAndChild>(
+      GetAllocationHandle(), MakeGarbageCollected<GCed>(GetAllocationHandle()),
+      [&persistent](GCedWithCallbackAndChild* obj) {
+        persistent->object = obj;
+      });
+  GetMarkerRef()->IncrementalMarkingStepForTesting(
+      GarbageCollector::Config::StackState::kNoHeapPointers);
+  Heap::From(GetHeap())->FinalizeIncrementalGarbageCollectionIfRunning(config);
+}
+
 // Death tests.
 
 namespace {