Add CHECKs that the array buffers list is always sorted new to old

src/runtime/runtime-typedarray.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/arguments.h"
 #include "src/runtime/runtime.h"
 #include "src/runtime/runtime-utils.h"
 
@@ skipping 34 matching lines @@
   array_buffer->set_flag(Smi::FromInt(0));
   array_buffer->set_is_external(is_external);
   array_buffer->set_is_neuterable(true);
 
   Handle<Object> byte_length =
       isolate->factory()->NewNumberFromSize(allocated_length);
   CHECK(byte_length->IsSmi() || byte_length->IsHeapNumber());
   array_buffer->set_byte_length(*byte_length);
 
   array_buffer->set_weak_next(isolate->heap()->array_buffers_list());
+  CHECK(isolate->heap()->InNewSpace(*array_buffer));
   isolate->heap()->set_array_buffers_list(*array_buffer);
   array_buffer->set_weak_first_view(isolate->heap()->undefined_value());
 }
 
 
 bool Runtime::SetupArrayBufferAllocatingData(Isolate* isolate,
                                              Handle<JSArrayBuffer> array_buffer,
                                              size_t allocated_length,
                                              bool initialize) {
   void* data;
@@ skipping 736 matching lines @@
 DATA_VIEW_SETTER(Uint16, uint16_t)
 DATA_VIEW_SETTER(Int16, int16_t)
 DATA_VIEW_SETTER(Uint32, uint32_t)
 DATA_VIEW_SETTER(Int32, int32_t)
 DATA_VIEW_SETTER(Float32, float)
 DATA_VIEW_SETTER(Float64, double)
 
 #undef DATA_VIEW_SETTER
 }
 }  // namespace v8::internal