commit 8301a645fba6b5c170c411eea3965d8d6136a662
author Haruka Matsumura <harukamt@google.com> Tue Jul 31 13:18:42 2018
committer Commit Bot <commit-bot@chromium.org> Tue Jul 31 13:18:42 2018
tree 131a5f539909dacec69f4dee2c0172159f5eda2a
parent b0c4e26bb5fe004283ad47673565f4f82b880fa9

HeapCompaction: Fix a Crash bug in Relocate()

This CL fixes a crush bug in Relocate().
It is caused when we relocate backings that were dereferenced in EagerSweep/PreFinalizer/WeapProcessing.
The slots are no longer referenced so we can early return and fix the bug.

Bug: 869301
Change-Id: Id46854267065744f38f9be567b7d286f2175b99f
Reviewed-on: https://chromium-review.googlesource.com/1155329
Commit-Queue: Haruka Matsumura <harukamt@google.com>
Reviewed-by: Keishi Hattori <keishi@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#579384}

third_party/blink/renderer/platform/heap/heap_compact.cc

diff --git a/third_party/blink/renderer/platform/heap/heap_compact.cc b/third_party/blink/renderer/platform/heap/heap_compact.cc
index 3c9ab97..d0ab4ad 100644
--- a/third_party/blink/renderer/platform/heap/heap_compact.cc
+++ b/third_party/blink/renderer/platform/heap/heap_compact.cc
@@ -156,7 +156,14 @@
 
   void Relocate(Address from, Address to) {
     auto it = fixups_.find(from);
-    DCHECK(it != fixups_.end());
+    /// This means that there is no corresponding slot for a live backing store.
+    // This may happen because a mutator may change the slot to point to a
+    // different backing store after an incremental marking traced the slot (and
+    // marked the old backing store as live).
+    // As another case, this may happen becuase we may relocate backings that
+    // were dereferenced in EagerSweep/PreFinalizer/WeapProcessing.
+    if (it == fixups_.end())
+      return;
 #if DCHECK_IS_ON()
     BasePage* from_page = PageFromObject(from);
     DCHECK(relocatable_pages_.Contains(from_page));