[heap] Expand verification of layout changes to non-JSObject objects.

src/heap/heap.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_HEAP_HEAP_H_
 #define V8_HEAP_HEAP_H_
 
 #include <cmath>
 #include <vector>
 
@@ skipping 1240 matching lines @@
   IncrementalMarking* incremental_marking() { return incremental_marking_; }
 
   // ===========================================================================
   // Concurrent marking API. ===================================================
   // ===========================================================================
 
   ConcurrentMarking* concurrent_marking() { return concurrent_marking_; }
 
   // The runtime uses this function to notify potentially unsafe object layout
   // changes that require special synchronization with the concurrent marker.
-  // A layout change is unsafe if
-  // - it removes a tagged in-object field.
-  // - it replaces a tagged in-objects field with an untagged in-object field.
   void NotifyObjectLayoutChange(HeapObject* object,
                                 const DisallowHeapAllocation&);
+
 #ifdef VERIFY_HEAP
   // This function checks that either
   // - the map transition is safe,
   // - or it was communicated to GC using NotifyObjectLayoutChange.
   void VerifyObjectLayoutChange(HeapObject* object, Map* new_map);
 #endif
 
   // ===========================================================================
   // Embedder heap tracer support. =============================================
   // ===========================================================================
@@ skipping 1371 matching lines @@
   friend class PagedSpace;
   DISALLOW_COPY_AND_ASSIGN(AllocationObserver);
 };
 
 V8_EXPORT_PRIVATE const char* AllocationSpaceName(AllocationSpace space);
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_HEAP_HEAP_H_