Implement verification of context separation.

Implement verification of context separation.

This adds the --verify-global-context-separation flag which can be used
to verify that no code object embeds pointers to more than one global
context after a full GC. It uses an object visitor that just performs
shallow traversal of the object graph spanned by one code object, and
breaks at points where application objects are encountered. So it will
not trip on cross-context leaks introduced by the application itself.

R=verwaest@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=12224

[Toon Verwaest, 2012-07-30 10:09:38]

lgtm with comments.

https://chromiumcodereview.appspot.com/10830049/diff/1/src/flag-definitions.h
File src/flag-definitions.h (right):

https://chromiumcodereview.appspot.com/10830049/diff/1/src/flag-definitions.h...
src/flag-definitions.h:556: "verify that code embeds at most one global context
after GC")
embeds -> holds on to?

https://chromiumcodereview.appspot.com/10830049/diff/1/src/mark-compact.cc
File src/mark-compact.cc (right):

https://chromiumcodereview.appspot.com/10830049/diff/1/src/mark-compact.cc#ne...
src/mark-compact.cc:264: array->set_length(0);
Adding a comment here is probably useful. Why do we need this trick here but
don't we handle objects specially? Can't we use the same mechanism for arrays as
we do for objects somehow?

[Michael Starzinger, 2012-07-30 10:44:32]

Addressed comments. Landing.

https://chromiumcodereview.appspot.com/10830049/diff/1/src/flag-definitions.h
File src/flag-definitions.h (right):

https://chromiumcodereview.appspot.com/10830049/diff/1/src/flag-definitions.h...
src/flag-definitions.h:556: "verify that code embeds at most one global context
after GC")
On 2012/07/30 10:09:38, Toon Verwaest wrote:
> embeds -> holds on to?

Done.

https://chromiumcodereview.appspot.com/10830049/diff/1/src/mark-compact.cc
File src/mark-compact.cc (right):

https://chromiumcodereview.appspot.com/10830049/diff/1/src/mark-compact.cc#ne...
src/mark-compact.cc:264: array->set_length(0);
On 2012/07/30 10:09:38, Toon Verwaest wrote:
> Adding a comment here is probably useful. Why do we need this trick here but
> don't we handle objects specially? Can't we use the same mechanism for arrays
as
> we do for objects somehow?

Done. For JSObjects we don't have the problem, because we don't iterate over
their bodies. The external mark bits cannot be used because of lazy sweeping. We
could use intrusive marking, but that would make this visitor much more
complicated.