Insert a filler at the new space top even if the top is at the limit.

BUG=chromium:470390
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1066653003

Cr-Commit-Position: refs/heads/master@{#27819}

diff --git a/src/heap/heap.cc b/src/heap/heap.cc
index 274d9ef0c22e83a5cc1f92ad8a03da6e7b9c6244..9aef842684ed248f5544121b02aa1566a998078e 100644 (file)
--- a/src/heap/heap.cc
+++ b/src/heap/heap.cc
@@ -794,10 +794,14 @@ void Heap::EnsureFillerObjectAtTop() {
   // pointer of the new space page. We store a filler object there to
   // identify the unused space.
   Address from_top = new_space_.top();
-  Address from_limit = new_space_.limit();
-  if (from_top < from_limit) {
-    int remaining_in_page = static_cast<int>(from_limit - from_top);
-    CreateFillerObjectAt(from_top, remaining_in_page);
+  // Check that from_top is inside its page (i.e., not at the end).
+  Address space_end = new_space_.ToSpaceEnd();
+  if (from_top < space_end) {
+    Page* page = Page::FromAddress(from_top);
+    if (page->Contains(from_top)) {
+      int remaining_in_page = static_cast<int>(page->area_end() - from_top);
+      CreateFillerObjectAt(from_top, remaining_in_page);
+    }
   }
 }
 

diff --git a/test/cctest/test-mementos.cc b/test/cctest/test-mementos.cc
index 4c85151b88c11ed1a7cc11999c1393f62336df75..391c934475e86d6f51a45a16566e111256905700 100644 (file)
--- a/test/cctest/test-mementos.cc
+++ b/test/cctest/test-mementos.cc
@@ -58,9 +58,26 @@ TEST(Regress340063) {
   if (!i::FLAG_allocation_site_pretenuring) return;
   v8::HandleScope scope(CcTest::isolate());
 
+  SetUpNewSpaceWithPoisonedMementoAtTop();
+
+  // Call GC to see if we can handle a poisonous memento right after the
+  // current new space top pointer.
+  CcTest::i_isolate()->heap()->CollectAllGarbage(
+      Heap::kAbortIncrementalMarkingMask);
+}
+
+
+TEST(Regress470390) {
+  CcTest::InitializeVM();
+  if (!i::FLAG_allocation_site_pretenuring) return;
+  v8::HandleScope scope(CcTest::isolate());
 
   SetUpNewSpaceWithPoisonedMementoAtTop();
 
+  // Set the new space limit to be equal to the top.
+  Address top = CcTest::i_isolate()->heap()->new_space()->top();
+  *(CcTest::i_isolate()->heap()->new_space()->allocation_limit_address()) = top;
+
   // Call GC to see if we can handle a poisonous memento right after the
   // current new space top pointer.
   CcTest::i_isolate()->heap()->CollectAllGarbage(