Strengthen a few assertions and add zapping of allocated...

src/heap-inl.h

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 134 matching lines @@
   Counters::objs_since_last_full.Increment();
   Counters::objs_since_last_young.Increment();
 #endif
   Object* result = cell_space_->AllocateRaw(JSGlobalPropertyCell::kSize);
   if (result->IsFailure()) old_gen_exhausted_ = true;
   return result;
 }
 
 
 bool Heap::InNewSpace(Object* object) {
-  return new_space_.Contains(object);
+  bool result = new_space_.Contains(object);
+  ASSERT(!result ||                  // Either not in new space
+         gc_state_ != NOT_IN_GC ||   // ... or in the middle of GC
+         InToSpace(object));         // ... or in to-space (where we allocate).
+  return result;
 }
 
 
 bool Heap::InFromSpace(Object* object) {
   return new_space_.FromSpaceContains(object);
 }
 
 
 bool Heap::InToSpace(Object* object) {
   return new_space_.ToSpaceContains(object);
@@ skipping 232 matching lines @@
 
 
 void ExternalStringTable::ShrinkNewStrings(int position) {
   new_space_strings_.Rewind(position);
   Verify();
 }
 
 } }  // namespace v8::internal
 
 #endif  // V8_HEAP_INL_H_