Swap bitfield3 and backpointer.

src/mark-compact.cc

Index: src/mark-compact.cc
diff --git a/src/mark-compact.cc b/src/mark-compact.cc
index 0e6c59e0767cd2d8fd1f5b47625ad7045ce6b94a..6245785ab995b7be54f3d0d2d1dff8b0068ad011 100644
--- a/src/mark-compact.cc
+++ b/src/mark-compact.cc
@@ -1829,20 +1829,22 @@ void Marker<T>::MarkMapContents(Map* map) {
   base_marker()->MarkObjectAndPush(HeapObject::cast(map->GetBackPointer()));
 
   Object** descriptor_array_slot =
-      HeapObject::RawField(map, Map::kInstanceDescriptorsOrBitField3Offset);
+      HeapObject::RawField(map, Map::kInstanceDescriptorsOrBackPointerOffset);
   Object* descriptor_array = *descriptor_array_slot;
-  if (!descriptor_array->IsSmi()) {
+  if (descriptor_array->IsDescriptorArray()) {
     MarkDescriptorArray(reinterpret_cast<DescriptorArray*>(descriptor_array));
+  } else {
+    ASSERT(descriptor_array->IsMap() || descriptor_array->IsUndefined());

[Jakob Kummerow, 2012/07/10 12:26:25]

When descriptor_array->IsMap(), then it's the back pointer, right? How about
marking that (as the comment above says)?

[Toon Verwaest, 2012/07/10 13:28:28]

It's already marked above, by accessing map->GetBackPointer().

On 2012/07/10 12:26:25, Jakob wrote:

   }
 
   // Mark the Object* fields of the Map. Since the descriptor array has been
   // marked already, it is fine that one of these fields contains a pointer
   // to it. But make sure to skip back pointer.
   STATIC_ASSERT(Map::kPointerFieldsEndOffset ==
-                Map::kBackPointerOffset + kPointerSize);
+                Map::kBitField3Offset + kPointerSize);
   Object** start_slot =
       HeapObject::RawField(map, Map::kPointerFieldsBeginOffset);
-  Object** end_slot = HeapObject::RawField(map, Map::kBackPointerOffset);
+  Object** end_slot = HeapObject::RawField(map, Map::kBitField3Offset);
   for (Object** slot = start_slot; slot < end_slot; slot++) {
     Object* obj = *slot;
     if (!obj->NonFailureIsHeapObject()) continue;