[heap] Fix InvalidatedSlotsFilter.

On advancing the iterator we need to reset the current object,
so that it can be lazily reloaded later on.

TBR=mlippautz@chromium.org

Bug: chromium:694255
Change-Id: If7ddd8670df9d11837f491503312919b55b451fe
Reviewed-on: https://chromium-review.googlesource.com/600687
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47142}

src/heap/invalidated-slots-inl.h

@@ -31,6 +31,8 @@ bool InvalidatedSlotsFilter::IsValid(Address slot) {
       DCHECK_LE(invalidated_end_, iterator_->first->address());
       invalidated_start_ = iterator_->first->address();
       invalidated_end_ = invalidated_start_ + iterator_->second;
+      invalidated_object_ = nullptr;
+      invalidated_object_size_ = 0;
     } else {
       invalidated_start_ = sentinel_;
       invalidated_end_ = sentinel_;

test/cctest/heap/heap-tester.h

@@ -20,6 +20,7 @@
   V(InvalidatedSlotsAllInvalidatedRanges)                 \
   V(InvalidatedSlotsEvacuationCandidate)                  \
   V(InvalidatedSlotsNoInvalidatedRanges)                  \
+  V(InvalidatedSlotsResetObjectRegression)                \
   V(InvalidatedSlotsSomeInvalidatedRanges)                \
   V(TestNewSpaceRefsInCopiedCode)                         \
   V(GCFlags)                                              \

test/cctest/heap/test-invalidated-slots.cc

@@ -157,5 +157,29 @@ HEAP_TEST(InvalidatedSlotsEvacuationCandidate) {
   }
 }
 
+HEAP_TEST(InvalidatedSlotsResetObjectRegression) {
+  CcTest::InitializeVM();
+  Heap* heap = CcTest::heap();
+  std::vector<ByteArray*> byte_arrays;
+  Page* page = AllocateByteArraysOnPage(heap, &byte_arrays);
+  // Ensure that the first array has smaller size then the rest.
+  heap->RightTrimFixedArray(byte_arrays[0], byte_arrays[0]->length() - 8);
+  // Register the all byte arrays as invalidated.
+  for (size_t i = 0; i < byte_arrays.size(); i++) {
+    page->RegisterObjectWithInvalidatedSlots(byte_arrays[i],
+                                             byte_arrays[i]->Size());
+  }
+  // All slots must still be invalid.
+  InvalidatedSlotsFilter filter(page);
+  for (size_t i = 0; i < byte_arrays.size(); i++) {
+    ByteArray* byte_array = byte_arrays[i];
+    Address start = byte_array->address() + ByteArray::kHeaderSize;
+    Address end = byte_array->address() + byte_array->Size();
+    for (Address addr = start; addr < end; addr += kPointerSize) {
+      CHECK(!filter.IsValid(addr));
+    }
+  }
+}
+
 }  // namespace internal
 }  // namespace v8