Heap snapshot doesn't detect the fact that an old object was overriden by new one.

test/cctest/test-heap-profiler.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 //
 // Tests for heap profiler
 
 #include <ctype.h>
 
 #include "v8.h"
 
 #include "cctest.h"
 #include "hashmap.h"
@@ skipping 342 matching lines @@
 
 
 // Trying to introduce a check helper for uint32_t causes many
 // overloading ambiguities, so it seems easier just to cast
 // them to a signed type.
 #define CHECK_EQ_SNAPSHOT_OBJECT_ID(a, b) \
   CHECK_EQ(static_cast<int32_t>(a), static_cast<int32_t>(b))
 #define CHECK_NE_SNAPSHOT_OBJECT_ID(a, b) \
   CHECK((a) != (b))  // NOLINT
 
+TEST(HeapSnapshotAddressReuse) {
+  v8::HandleScope scope;
+  LocalContext env;
+
+  CompileRun(
+      "function A() {}\n"
+      "var a = [];\n"
+      "for (var i = 0; i < 10000; ++i)\n"
+      "  a[i] = new A();\n");
+  const v8::HeapSnapshot* snapshot1 =
+      v8::HeapProfiler::TakeSnapshot(v8_str("snapshot1"));
+  v8::SnapshotObjectId maxId1 = snapshot1->GetMaxSnapshotJSObjectId();
+
+  CompileRun(
+      "for (var i = 0; i < 10000; ++i)\n"
+      "  a[i] = new A();\n");
+  HEAP->CollectAllGarbage(i::Heap::kNoGCFlags);
+
+  const v8::HeapSnapshot* snapshot2 =
+      v8::HeapProfiler::TakeSnapshot(v8_str("snapshot2"));
+  const v8::HeapGraphNode* global2 = GetGlobalObject(snapshot2);
+
+  const v8::HeapGraphNode* array_node =
+      GetProperty(global2, v8::HeapGraphEdge::kProperty, "a");
+  CHECK_NE(NULL, array_node);
+  int wrong_count = 0;
+  for (int i = 0, count = array_node->GetChildrenCount(); i < count; ++i) {
+    const v8::HeapGraphEdge* prop = array_node->GetChild(i);
+    if (prop->GetType() != v8::HeapGraphEdge::kElement)
+      continue;
+    v8::SnapshotObjectId id = prop->GetToNode()->GetId();
+    if (id < maxId1)
+      ++wrong_count;
+  }
+  // FIXME: Object ids should be unique but it is not so at the moment.
+  CHECK_NE(0, wrong_count);
+}
+
+
 TEST(HeapEntryIdsAndArrayShift) {
   v8::HandleScope scope;
   LocalContext env;
 
   CompileRun(
       "function AnObject() {\n"
       "    this.first = 'first';\n"
       "    this.second = 'second';\n"
       "}\n"
       "var a = new Array();\n"
@@ skipping 1282 matching lines @@
   const v8::HeapGraphNode* map =
       GetProperty(global_object, v8::HeapGraphEdge::kInternal, "map");
   CHECK_NE(NULL, map);
   const v8::HeapGraphNode* own_descriptors = GetProperty(
       map, v8::HeapGraphEdge::kInternal, "descriptors");
   CHECK_NE(NULL, own_descriptors);
   const v8::HeapGraphNode* own_transitions = GetProperty(
       map, v8::HeapGraphEdge::kInternal, "transitions");
   CHECK_EQ(NULL, own_transitions);
 }