Add regression test for issue 507979.

Regression test for CL 3eb91e8aec8e628adc1046fca16c5dfd1d129118.

BUG=chromium:507979
LOG=N

Review URL: https://codereview.chromium.org/1255173002

Cr-Commit-Position: refs/heads/master@{#29873}

diff --git a/test/cctest/test-heap.cc b/test/cctest/test-heap.cc
index f899a27c7fd3ef3a0638cb46c9444d311832606a..87978c0d78f7b602d16b77e90b65432c52499a34 100644 (file)
--- a/test/cctest/test-heap.cc
+++ b/test/cctest/test-heap.cc
@@ -5282,6 +5282,31 @@ TEST(Regress357137) {
 }
 
 
+TEST(Regress507979) {
+  const int kFixedArrayLen = 10;
+  CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+  Heap* heap = isolate->heap();
+  HandleScope handle_scope(isolate);
+
+  Handle<FixedArray> o1 = isolate->factory()->NewFixedArray(kFixedArrayLen);
+  Handle<FixedArray> o2 = isolate->factory()->NewFixedArray(kFixedArrayLen);
+  CHECK(heap->InNewSpace(o1->address()));
+  CHECK(heap->InNewSpace(o2->address()));
+
+  HeapIterator it(heap, i::HeapIterator::kFilterUnreachable);
+
+  // Replace parts of an object placed before a live object with a filler. This
+  // way the filler object shares the mark bits with the following live object.
+  o1->Shrink(kFixedArrayLen - 1);
+
+  for (HeapObject* obj = it.next(); obj != NULL; obj = it.next()) {
+    // Let's not optimize the loop away.
+    CHECK(obj->address() != nullptr);
+  }
+}
+
+
 TEST(ArrayShiftSweeping) {
   i::FLAG_expose_gc = true;
   CcTest::InitializeVM();