Verify that double unboxing is never performed on large objects.

src/heap/spaces.cc

Index: src/heap/spaces.cc
diff --git a/src/heap/spaces.cc b/src/heap/spaces.cc
index 0806b2565da68f802c9b06041efd8fe9858312dc..dfaac73ffd10a4c7722a4ebd70d33bb8aa7d063a 100644
--- a/src/heap/spaces.cc
+++ b/src/heap/spaces.cc
@@ -3046,6 +3046,11 @@ void LargeObjectSpace::Verify() {
     CHECK(map->IsMap());
     CHECK(heap()->map_space()->Contains(map));
 
+    // Double unboxing in LO space is not allowed. This would break the
+    // lookup mechanism for store and slot buffer entries which use the
+    // page header tag.
+    CHECK(object->ContentType() != HeapObjectContents::kMixedValues);
+
     // We have only code, sequential strings, external strings
     // (sequential strings that have been morphed into external
     // strings), fixed arrays, byte arrays, and constant pool arrays in the