Added check to debug object migration crashes.

src/mark-compact.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2716 matching lines @@
     Address dst_slot = dst;
     ASSERT(IsAligned(size, kPointerSize));
 
     for (int remaining = size / kPointerSize; remaining > 0; remaining--) {
       Object* value = Memory::Object_at(src_slot);
 
       Memory::Object_at(dst_slot) = value;
 
       if (heap_->InNewSpace(value)) {
         heap_->store_buffer()->Mark(dst_slot);
-      } else if (value->IsHeapObject() && IsOnEvacuationCandidate(value)) {
-        SlotsBuffer::AddTo(&slots_buffer_allocator_,
-                           &migration_slots_buffer_,
-                           reinterpret_cast<Object**>(dst_slot),
-                           SlotsBuffer::IGNORE_OVERFLOW);
+      } else if (value->IsHeapObject()) {
+        CHECK(heap_->TargetSpace(HeapObject::FromAddress(src)) ==

[Michael Starzinger, 2013/07/23 21:10:47]

Please add a TODO here that this should be turned into an ASSERT soon. We only
want this for one or two Canary builds.

Also this ASSERT has nothing to do with this particular location. It has to hold
at method entry after the destination space has been checked (e.g. at line
2728). Please move it up, out of the loop.

[Hannes Payer (out of office), 2013/07/24 09:04:12]

Done.

+              heap_->old_pointer_space());
+        if (IsOnEvacuationCandidate(value)) {
+          SlotsBuffer::AddTo(&slots_buffer_allocator_,
+                             &migration_slots_buffer_,
+                             reinterpret_cast<Object**>(dst_slot),
+                             SlotsBuffer::IGNORE_OVERFLOW);
+        }
       }
 
       src_slot += kPointerSize;
       dst_slot += kPointerSize;
     }
 
     if (compacting_ && HeapObject::FromAddress(dst)->IsJSFunction()) {
       Address code_entry_slot = dst + JSFunction::kCodeEntryOffset;
       Address code_entry = Memory::Address_at(code_entry_slot);
 
@@ skipping 1559 matching lines @@
   while (buffer != NULL) {
     SlotsBuffer* next_buffer = buffer->next();
     DeallocateBuffer(buffer);
     buffer = next_buffer;
   }
   *buffer_address = NULL;
 }
 
 
 } }  // namespace v8::internal