Only mark the descriptor that is valid for the map in question. If this map

src/objects-visiting-inl.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 378 matching lines @@
   // array slot, since it will be implicitly recorded when the pointer
   // fields of this map are visited.
   TransitionArray* transitions = map->unchecked_transition_array();
   if (transitions->IsTransitionArray()) {
     MarkTransitionArray(heap, transitions);
   } else {
     // Already marked by marking map->GetBackPointer() above.
     ASSERT(transitions->IsMap() || transitions->IsUndefined());
   }
 
+  // Since descriptor arrays are potentially shared, ensure that only the
+  // descriptors that appeared for this map are marked. The first time a
+  // non-empty descriptor array is marked, its header is also marked. The slot

[Michael Starzinger, 2013/01/31 10:44:09]

s/its header is also marked/its header is also visited/

[Toon Verwaest, 2013/01/31 10:50:02]

Done.

+  // holding the descriptor array will be implicitly recorded when the pointer
+  // fields of this map are visited.
+  DescriptorArray* descriptors = map->instance_descriptors();
+  if (StaticVisitor::MarkObjectWithoutPush(heap, descriptors) &&
+      descriptors->length() > 0) {
+    StaticVisitor::VisitPointers(heap,
+      descriptors->GetFirstElementAddress(),

[Michael Starzinger, 2013/01/31 10:44:09]

Indent by 4 instead of 2 characters.

[Toon Verwaest, 2013/01/31 10:50:02]

Done.

+      descriptors->GetDescriptorEndSlot(0));
+  }
+  int start = 0;
+  int end = map->NumberOfOwnDescriptors();
+  Object* back_pointer = map->GetBackPointer();
+  if (!back_pointer->IsUndefined()) {
+    Map* parent_map = Map::cast(back_pointer);
+    if (descriptors == parent_map->instance_descriptors()) {
+      start = parent_map->NumberOfOwnDescriptors();
+    }
+  }
+  if (start < end) {
+    StaticVisitor::VisitPointers(heap,
+        descriptors->GetDescriptorStartSlot(start),
+        descriptors->GetDescriptorEndSlot(end));
+  }
+
   // Mark prototype dependent codes array but do not push it onto marking
   // stack, this will make references from it weak. We will clean dead
   // codes when we iterate over maps in ClearNonLiveTransitions.
   Object** slot = HeapObject::RawField(map, Map::kDependentCodesOffset);
   HeapObject* obj = HeapObject::cast(*slot);
   heap->mark_compact_collector()->RecordSlot(slot, slot, obj);
   StaticVisitor::MarkObjectWithoutPush(heap, obj);
 
   // Mark the pointer fields of the Map. Since the transitions array has
   // been marked already, it is fine that one of these fields contains a
@@ skipping 280 matching lines @@
   RelocIterator it(this, mode_mask);
   for (; !it.done(); it.next()) {
     it.rinfo()->template Visit<StaticVisitor>(heap);
   }
 }
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_OBJECTS_VISITING_INL_H_