[heap] Expand verification of layout changes to non-JSObject objects.

src/heap/incremental-marking.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/heap/incremental-marking.h"
 
 #include "src/code-stubs.h"
 #include "src/compilation-cache.h"
 #include "src/conversions.h"
 #include "src/heap/concurrent-marking.h"
@@ skipping 855 matching lines @@
 
 void IncrementalMarking::VisitObject(Map* map, HeapObject* obj, int size) {
   MarkBit mark_bit = ObjectMarking::MarkBitFrom(obj, marking_state(obj));
   DCHECK(Marking::IsGrey<kAtomicity>(mark_bit) ||
          Marking::IsBlack<kAtomicity>(mark_bit));
   USE(mark_bit);
   // The object can already be black in two cases:
   // 1. The object is a fixed array with the progress bar.
   // 2. The object is a JSObject that was colored black before
   //    unsafe layout change.
+  // 3. The object is a string that was colored black before
+  //    unsafe layout change.
   if (!ObjectMarking::GreyToBlack<kAtomicity>(obj, marking_state(obj))) {
-    DCHECK(IsFixedArrayWithProgressBar(obj) || obj->IsJSObject());
+    DCHECK(IsFixedArrayWithProgressBar(obj) || obj->IsJSObject() ||
+           obj->IsString());
   }
   DCHECK(ObjectMarking::IsBlack<kAtomicity>(obj, marking_state(obj)));
   WhiteToGreyAndPush(map);
   IncrementalMarkingMarkingVisitor::IterateBody(map, obj);
 }
 
 intptr_t IncrementalMarking::ProcessMarkingDeque(
     intptr_t bytes_to_process, ForceCompletionAction completion) {
   intptr_t bytes_processed = 0;
   while (!marking_deque()->IsEmpty() && (bytes_processed < bytes_to_process ||
@@ skipping 336 matching lines @@
   idle_marking_delay_counter_++;
 }
 
 
 void IncrementalMarking::ClearIdleMarkingDelayCounter() {
   idle_marking_delay_counter_ = 0;
 }
 
 }  // namespace internal
 }  // namespace v8