FIx crash in disassembler: check that an addrs is tagged before testing it to be part of the heap.

runtime/vm/assembler_ia32.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"
 #if defined(TARGET_ARCH_IA32)
 
 #include "vm/assembler.h"
 #include "vm/heap.h"
 #include "vm/memory_region.h"
@@ skipping 1343 matching lines @@
     addl(ESP, Immediate(stack_elements * kWordSize));
   }
 }
 
 
 void Assembler::LoadObject(Register dst, const Object& object) {
   if (object.IsSmi() || object.IsNull()) {
     movl(dst, Immediate(reinterpret_cast<int32_t>(object.raw())));
   } else {
     ASSERT(object.IsZoneHandle());
+    ASSERT(object.IsOld());
     AssemblerBuffer::EnsureCapacity ensured(&buffer_);
     EmitUint8(0xB8 + dst);
     buffer_.EmitObject(object);
   }
 }
 
 
 void Assembler::PushObject(const Object& object) {
   if (object.IsSmi() || object.IsNull()) {
     pushl(Immediate(reinterpret_cast<int32_t>(object.raw())));
   } else {
     ASSERT(object.IsZoneHandle());
+    ASSERT(object.IsOld());
     AssemblerBuffer::EnsureCapacity ensured(&buffer_);
     EmitUint8(0x68);
     buffer_.EmitObject(object);
   }
 }
 
 
 void Assembler::CompareObject(Register reg, const Object& object) {
   if (object.IsSmi() || object.IsNull()) {
     cmpl(reg, Immediate(reinterpret_cast<int32_t>(object.raw())));
   } else {
     ASSERT(object.IsZoneHandle());
+    ASSERT(object.IsOld());
     AssemblerBuffer::EnsureCapacity ensured(&buffer_);
     if (reg == EAX) {
       EmitUint8(0x05 + (7 << 3));
       buffer_.EmitObject(object);
     } else {
       EmitUint8(0x81);
       EmitOperand(7, Operand(reg));
       buffer_.EmitObject(object);
     }
   }
@@ skipping 440 matching lines @@
 
 const char* Assembler::XmmRegisterName(XmmRegister reg) {
   ASSERT((0 <= reg) && (reg < kNumberOfXmmRegisters));
   return xmm_reg_names[reg];
 }
 
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_IA32