This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Reproduces on TOT (73a5db9d06051d85724b5846af3b3cb8aa97f60e) on x64.optdebug.
The allocation_site() field of an AllocationMemento points to unmapped page.

#0  IsAllocationSite (this=0xbed9112b0f9) at ../../src/objects-inl.h:959
#1  IsValid (this=<optimized out>) at ../../src/objects-inl.h:1780
#2  v8::internal::Heap::FindAllocationMemento<(v8::internal::Heap::FindMementoMode)0> (this=0x11b3010, object=0x2c2b59bfff91)
    at ../../src/heap/heap-inl.h:517
#3  0x0000000000819260 in v8::internal::JSObject::UpdateAllocationSite (object=..., 
    to_kind=v8::internal::FAST_HOLEY_SMI_ELEMENTS) at ../../src/objects.cc:15281
#4  0x000000000067cc8d in BasicGrowCapacityAndConvertImpl (to_kind=v8::internal::FAST_HOLEY_SMI_ELEMENTS, object=..., 
    old_elements=..., from_kind=<optimized out>, capacity=<optimized out>) at ../../src/elements.cc:856
#5  v8::internal::(anonymous namespace)::ElementsAccessorBase<v8::internal::(anonymous namespace)::FastHoleySmiElementsAccessor, v8::internal::(anonymous namespace)::ElementsKindTraits<(v8::internal::ElementsKind)1> >::GrowCapacityAndConvertImpl (
    object=..., capacity=<optimized out>) at ../../src/elements.cc:841
#6  0x000000000067ca3d in v8::internal::(anonymous namespace)::ElementsAccessorBase<v8::internal::(anonymous namespace)::FastHoleySmiElementsAccessor, v8::internal::(anonymous namespace)::ElementsKindTraits<(v8::internal::ElementsKind)1> >::SetLengthImpl
    (isolate=<optimized out>, array=..., length=1, backing_store=...) at ../../src/elements.cc:727
#7  0x000000000067b421 in v8::internal::(anonymous namespace)::ElementsAccessorBase<v8::internal::(anonymous namespace)::FastHoleySmiElementsAccessor, v8::internal::(anonymous namespace)::ElementsKindTraits<(v8::internal::ElementsKind)1> >::SetLength (
    this=<optimized out>, array=..., length=1) at ../../src/elements.cc:682
#8  0x00000000007f971c in v8::internal::JSArray::SetLength (array=..., new_length=1) at ../../src/objects.cc:14455
#9  0x0000000000a0e987 in v8::internal::Accessors::ArrayLengthSetter (name=..., val=..., info=...)
    at ../../src/accessors.cc:179
#10 0x00000000007684ae in v8::internal::PropertyCallbackArguments::Call (this=0x7ffffff3da30, f=<optimized out>, name=..., 
    value=...) at ../../src/api-arguments-inl.h:101
#11 0x0000000000764dec in v8::internal::__RT_impl_Runtime_StoreCallbackProperty (args=..., isolate=0x11b2ff0)
    at ../../src/ic/ic.cc:2823
#12 0x0000000000764ab0 in v8::internal::Runtime_StoreCallbackProperty (args_length=6, args_object=<optimized out>, 
    isolate=0x11b2ff0) at ../../src/ic/ic.cc:2792
#13 0x000009a8bf7063a7 in ?? ()

Hi Michael,
This issue bisects cleanly to your CL:

Reland "[heap] Add page evacuation mode for new->new"

Adds an evacuation mode that allows moving pages within new space without
    copying objects.
https://codereview.chromium.org/2078863002


It looks like there must be a way to add an allocation memento that points to a dead AllocationSite. I remember we had an issue once that we didn't scan new space until sweeping old space...and during that sweep we might have discarded allocation sites. I believe this is why we introduced the "zombie" state to the AllocationSite.

Could it be a similar problem going on for this new work?

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/e97b8686f234c4f49bec8f31bd1702d6908901cc

commit e97b8686f234c4f49bec8f31bd1702d6908901cc
Author: mlippautz <mlippautz@chromium.org>
Date: Wed Jul 27 12:16:22 2016

[heap] Don't consider mementos on pages below age mark

Objects that reside below the age mark could be on pages that have been moved
within new space. In this case mementos survived which can actually point to
already-collected allocation sites.

BUG= chromium:631050 ,chromium:581412
R=hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2179033005
Cr-Commit-Position: refs/heads/master@{#38094}

[modify] https://crrev.com/e97b8686f234c4f49bec8f31bd1702d6908901cc/src/heap/heap-inl.h
[add] https://crrev.com/e97b8686f234c4f49bec8f31bd1702d6908901cc/test/mjsunit/regress/regress-631050.js

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot