Added a promotion queue unit test that test promotion queue memory corruption

src/heap.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
 #include "src/api.h"
 #include "src/base/once.h"
 #include "src/base/utils/random-number-generator.h"
@@ skipping 1932 matching lines @@
     }
   }
 
   // Helper function used by CopyObject to copy a source object to an
   // allocated target object and update the forwarding pointer in the source
   // object.  Returns the target object.
   INLINE(static void MigrateObject(Heap* heap,
                                    HeapObject* source,
                                    HeapObject* target,
                                    int size)) {
+    ASSERT(!heap->InToSpace(target) ||

[titzer, 2014/07/01 11:58:20]

Comments here too?

[Hannes Payer (out of office), 2014/07/01 16:08:11]

Done.

+        heap->promotion_queue()->IsBelowPromotionQueue(
+            target->address() + size));
+
     // Copy the content of source to target.
     heap->CopyBlock(target->address(), source->address(), size);
 
     // Set the forwarding address.
     source->set_map_word(MapWord::FromForwardingAddress(target));
 
     if (logging_and_profiling_mode == LOGGING_AND_PROFILING_ENABLED) {
       // Update NewSpace stats if necessary.
       RecordCopiedObject(heap, target);
       heap->OnMoveEvent(target, source, size);
@@ skipping 4480 matching lines @@
       static_cast<int>(object_sizes_last_time_[index]));
   CODE_AGE_LIST_COMPLETE(ADJUST_LAST_TIME_OBJECT_COUNT)
 #undef ADJUST_LAST_TIME_OBJECT_COUNT
 
   MemCopy(object_counts_last_time_, object_counts_, sizeof(object_counts_));
   MemCopy(object_sizes_last_time_, object_sizes_, sizeof(object_sizes_));
   ClearObjectStats();
 }
 
 } }  // namespace v8::internal