[heap] Fix verification of unsafe object layout changes.

src/heap/concurrent-marking.cc

 // Copyright 2017 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/heap/concurrent-marking.h"
 
 #include <stack>
 #include <unordered_map>
 
 #include "src/heap/concurrent-marking-deque.h"
@@ skipping 175 matching lines @@
             base::NoBarrier_Load(reinterpret_cast<const base::AtomicWord*>(p)));
         slot_snapshot_->add(p, object);
       }
     }
 
    private:
     SlotSnapshot* slot_snapshot_;
   };
 
   const SlotSnapshot& MakeSlotSnapshot(Map* map, HeapObject* object, int size) {
+    // TODO(ulan): Iterate only the existing fields and skip slack at the end
+    // of the object.
     SlotSnapshottingVisitor visitor(&slot_snapshot_);
     visitor.VisitPointer(object,
                          reinterpret_cast<Object**>(object->map_slot()));
     JSObject::BodyDescriptor::IterateBody(object, size, &visitor);
     return slot_snapshot_;
   }
 
   MarkingState marking_state(HeapObject* object) const {
     return MarkingState::Internal(object);
   }
@@ skipping 72 matching lines @@
 }
 
 void ConcurrentMarking::EnsureTaskCompleted() {
   if (IsTaskPending()) {
     WaitForTaskToComplete();
   }
 }
 
 }  // namespace internal
 }  // namespace v8