Avoid object layout changes during GC.

src/messages.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1070 matching lines @@
   return constructorName;
 }
 
 
 function captureStackTrace(obj, cons_opt) {
   var stackTraceLimit = $Error.stackTraceLimit;
   if (!stackTraceLimit || !IS_NUMBER(stackTraceLimit)) return;
   if (stackTraceLimit < 0 || stackTraceLimit > 10000) {
     stackTraceLimit = 10000;
   }
-  var raw_stack = %CollectStackTrace(obj,
-                                     cons_opt ? cons_opt : captureStackTrace,
-                                     stackTraceLimit);
+  var stack = %CollectStackTrace(obj,
+                                 cons_opt ? cons_opt : captureStackTrace,
+                                 stackTraceLimit);
 
   // Don't be lazy if the error stack formatting is custom (observable).
   if (IS_FUNCTION($Error.prepareStackTrace)) {
     var custom_stacktrace_fun = $Error.prepareStackTrace;
     // Use default error formatting for the case that custom formatting throws.
     $Error.prepareStackTrace = null;
     var array = [];
-    %MoveArrayContents(GetStackFrames(raw_stack), array);
+    %MoveArrayContents(GetStackFrames(stack), array);
     obj.stack = custom_stacktrace_fun(obj, array);
     $Error.prepareStackTrace = custom_stacktrace_fun;
     return;
   }
 
   var error_string = FormatErrorString(obj);
   // Note that 'obj' and 'this' maybe different when called on objects that
   // have the error object on its prototype chain.  The getter replaces itself
   // with a data property as soon as the stack trace has been formatted.
+  // The getter must not change the object layout as it may be called after GC.
   var getter = function() {
-    var value = FormatStackTrace(error_string, GetStackFrames(raw_stack));
-    %DefineOrRedefineDataProperty(obj, 'stack', value, NONE);
-    return value;
+    if (IS_STRING(stack)) return stack;
+    // Stack is still a raw array awaiting to be formatted.
+    stack = FormatStackTrace(error_string, GetStackFrames(stack));
+    // Release context value.
+    error_string = void 0;
+    return stack;
   };
   %MarkOneShotGetter(getter);
 
   // The 'stack' property of the receiver is set as data property.  If
   // the receiver is the same as holder, this accessor pair is replaced.
   var setter = function(v) {
     %DefineOrRedefineDataProperty(this, 'stack', v, NONE);
   };
 
   %DefineOrRedefineAccessorProperty(obj, 'stack', getter, setter, DONT_ENUM);
@@ skipping 131 matching lines @@
 function SetUpStackOverflowBoilerplate() {
   var boilerplate = MakeRangeError('stack_overflow', []);
 
   // The raw stack trace is stored as hidden property of the copy of this
   // boilerplate error object.  Note that the receiver 'this' may not be that
   // error object copy, but can be found on the prototype chain of 'this'.
   // When the stack trace is formatted, this accessor property is replaced by
   // a data property.
   var error_string = boilerplate.name + ": " + boilerplate.message;
 
+  // The getter must not change the object layout as it may be called after GC.
   function getter() {
     var holder = this;
     while (!IS_ERROR(holder)) {
       holder = %GetPrototype(holder);
       if (holder == null) return MakeSyntaxError('illegal_access', []);
     }
-    var raw_stack = %GetOverflowedRawStackTrace(holder);
-    var result = IS_ARRAY(raw_stack)
-                     ? FormatStackTrace(error_string, GetStackFrames(raw_stack))
-                     : void 0;
-    %DefineOrRedefineDataProperty(holder, 'stack', result, NONE);
-    return result;
+    var stack = %GetOverflowedStackTrace(holder);
+    if (IS_STRING(stack)) return stack;
+    if (IS_ARRAY(stack)) {
+      var result = FormatStackTrace(error_string, GetStackFrames(stack));
+      %SetOverflowedStackTrace(holder, result);
+      return result;
+    }
+    return void 0;
   }
   %MarkOneShotGetter(getter);
 
   // The 'stack' property of the receiver is set as data property.  If
   // the receiver is the same as holder, this accessor pair is replaced.
   function setter(v) {
     %DefineOrRedefineDataProperty(this, 'stack', v, NONE);
+    // Release the stack trace that is stored as hidden property, if exists.
+    %SetOverflowedStackTrace(this, void 0);
   }
 
   %DefineOrRedefineAccessorProperty(
       boilerplate, 'stack', getter, setter, DONT_ENUM);
 
   return boilerplate;
 }
 
 var kStackOverflowBoilerplate = SetUpStackOverflowBoilerplate();