heap: More diagnostics for compaction

Bug: 971424
Change-Id: I10c9379d0548ebeebe08e8ad08c69a959076a7e0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1660346Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#669841}

third_party/blink/renderer/platform/heap/heap_compact.cc

@@ -255,6 +255,35 @@ class HeapCompact::MovableObjectFixups final {
   }
 #endif
 
+  void VerifySlots() {
+    // TODO(918064): Remove this after investigation.
+    constexpr size_t kMaxNameLen = 256;
+    char slot_container_name[kMaxNameLen];
+    base::debug::Alias(slot_container_name);
+
+    for (auto it : fixups_) {
+      MovableReference object = it.first;
+      MovableReference* slot = it.second;
+      // Record name on stack.
+      const char* name = fixup_names_.find(slot)->second;
+      size_t len = strlen(name);
+      if (len > kMaxNameLen)
+        len = kMaxNameLen;
+      strncpy(slot_container_name, name, len);
+      slot_container_name[len - 1] = 0;
+      // Verify that slot either
+      // - points to the original object
+      // - points to null
+      // - points to a cleared hashtable entry
+      // - or points to a newly allocated object that will not be compacted.
+      MovableReference object_in_slot = *slot;
+      CHECK(object_in_slot == object || !object_in_slot ||
+            object_in_slot == reinterpret_cast<MovableReference>(-1) ||
+            !relocatable_pages_.Contains(heap_->LookupPageForAddress(
+                reinterpret_cast<Address>(object_in_slot))));
+    }
+  }
+
  private:
   void VerifyUpdatedSlot(MovableReference* slot);
 
@@ -449,6 +478,13 @@ void HeapCompact::Relocate(Address from, Address to) {
   Fixups().Relocate(from, to);
 }
 
+void HeapCompact::VerifySlots() {
+  if (!do_compact_)
+    return;
+
+  Fixups().VerifySlots();
+}
+
 void HeapCompact::FilterNonLiveSlots() {
   if (!do_compact_)
     return;

third_party/blink/renderer/platform/heap/heap_compact.h

@@ -77,6 +77,10 @@ class PLATFORM_EXPORT HeapCompact final {
   // die before being reached by the marker.
   void FilterNonLiveSlots();
 
+  // Verifies that all recorded slots are in consistent state, i.e., either
+  // point to valid objects that can be compacted or are cleared.
+  void VerifySlots();
+
   // Finishes compaction and clears internal state.
   void Finish();
 

third_party/blink/renderer/platform/heap/thread_state.cc

@@ -804,6 +804,13 @@ void ThreadState::AtomicPauseEpilogue(BlinkGC::MarkingType marking_type,
 
   EagerSweep();
 
+  {
+    ThreadHeapStatsCollector::Scope stats_scope(
+        Heap().stats_collector(),
+        ThreadHeapStatsCollector::kAtomicPhaseCompaction);
+    Heap().Compaction()->VerifySlots();
+  }
+
   // Any sweep compaction must happen after pre-finalizers and eager
   // sweeping, as it will finalize dead objects in compactable arenas
   // (e.g., backing stores for container objects.)