Introduce a base pointer field in FixedTypedArrayBase and teach GC about it

src/objects-debug.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/disasm.h"
 #include "src/disassembler.h"
 #include "src/heap/objects-visiting.h"
 #include "src/jsregexp.h"
@@ skipping 223 matching lines @@
 
 TYPED_ARRAYS(EXTERNAL_ARRAY_VERIFY)
 #undef EXTERNAL_ARRAY_VERIFY
 
 
 template <class Traits>
 void FixedTypedArray<Traits>::FixedTypedArrayVerify() {
   CHECK(IsHeapObject() &&
         HeapObject::cast(this)->map()->instance_type() ==
             Traits::kInstanceType);
+  CHECK(base_pointer() == this);
 }
 
 
 bool JSObject::ElementsAreSafeToExamine() {
   // If a GC was caused while constructing this object, the elements
   // pointer may point to a one pointer filler map.
   return reinterpret_cast<Map*>(elements()) !=
       GetHeap()->one_pointer_filler_map();
 }
 
@@ skipping 1017 matching lines @@
                          : it.rinfo()->target_object();
     CHECK(!CanLeak(target, heap, skip_weak_cell));
   }
 }
 
 
 #endif  // DEBUG
 
 }  // namespace internal
 }  // namespace v8