FIx crash in disassembler: check that an addrs is tagged before testing it to be part of the heap.

runtime/vm/assembler_ia32.cc

Index: runtime/vm/assembler_ia32.cc
===================================================================
--- runtime/vm/assembler_ia32.cc	(revision 12306)
+++ runtime/vm/assembler_ia32.cc	(working copy)
@@ -1361,6 +1361,7 @@
     movl(dst, Immediate(reinterpret_cast<int32_t>(object.raw())));
   } else {
     ASSERT(object.IsZoneHandle());
+    ASSERT(object.IsOld());
     AssemblerBuffer::EnsureCapacity ensured(&buffer_);
     EmitUint8(0xB8 + dst);
     buffer_.EmitObject(object);
@@ -1373,6 +1374,7 @@
     pushl(Immediate(reinterpret_cast<int32_t>(object.raw())));
   } else {
     ASSERT(object.IsZoneHandle());
+    ASSERT(object.IsOld());
     AssemblerBuffer::EnsureCapacity ensured(&buffer_);
     EmitUint8(0x68);
     buffer_.EmitObject(object);
@@ -1385,6 +1387,7 @@
     cmpl(reg, Immediate(reinterpret_cast<int32_t>(object.raw())));
   } else {
     ASSERT(object.IsZoneHandle());
+    ASSERT(object.IsOld());
     AssemblerBuffer::EnsureCapacity ensured(&buffer_);
     if (reg == EAX) {
       EmitUint8(0x05 + (7 << 3));