Deletion barrier preparation: validate overwritten references.

runtime/vm/freelist.cc

 // Copyright (c) 2011, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/freelist.h"
 
 #include <map>
 
 #include "vm/bit_set.h"
 #include "vm/lockers.h"
 #include "vm/object.h"
 #include "vm/raw_object.h"
 #include "vm/thread.h"
 
 namespace dart {
 
 
 FreeListElement* FreeListElement::AsElement(uword addr, intptr_t size) {
   // Precondition: the (page containing the) header of the element is
   // writable.
   ASSERT(size >= kObjectAlignment);
   ASSERT(Utils::IsAligned(size, kObjectAlignment));
 
   FreeListElement* result = reinterpret_cast<FreeListElement*>(addr);
 
   uword tags = 0;
   tags = RawObject::SizeTag::update(size, tags);
   tags = RawObject::ClassIdTag::update(kFreeListElement, tags);
+  // All words in a freelist element header must look like smis; see
+  // TryAllocateSmiInitializedLocked.
+  ASSERT(!reinterpret_cast<RawObject*>(tags)->IsHeapObject());
 
   result->tags_ = tags;
   if (size > RawObject::SizeTag::kMaxSizeTag) {
     *result->SizeAddress() = size;
   }
   result->set_next(NULL);
   return result;
   // Postcondition: the (page containing the) header of the element is
   // writable.
 }
@@ skipping 355 matching lines @@
     if (next_index != -1) {
       FreeListElement* element = DequeueElement(next_index);
       SplitElementAfterAndEnqueue(element, size, false);
       return reinterpret_cast<uword>(element);
     }
   }
   return 0;
 }
 
 }  // namespace dart