Deletion barrier preparation: validate overwritten references.

runtime/vm/freelist.h

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #ifndef VM_FREELIST_H_
 #define VM_FREELIST_H_
 
 #include "platform/assert.h"
 #include "vm/allocation.h"
 #include "vm/bit_set.h"
 #include "vm/raw_object.h"
 #include "vm/thread.h"
 
 namespace dart {
 
 // FreeListElement describes a freelist element.  Smallest FreeListElement is
 // two words in size.  Second word of the raw object is used to keep a next_
 // pointer to chain elements of the list together. For objects larger than the
 // object size encodable in tags field, the size of the element is embedded in
-// the element at the address following the next_ field.
+// the element at the address following the next_ field. All words written by
+// the freelist are guaranteed to look like smis, as required by
+// TryAllocateSmiInitializedLocked.
 class FreeListElement {
  public:
   FreeListElement* next() const {
     return next_;
   }
   uword next_address() const {
     return reinterpret_cast<uword>(&next_);
   }
 
   void set_next(FreeListElement* next) {
@@ skipping 95 matching lines @@
 
   // The largest available small size in bytes, or negative if there is none.
   intptr_t last_free_small_size_;
 
   DISALLOW_COPY_AND_ASSIGN(FreeList);
 };
 
 }  // namespace dart
 
 #endif  // VM_FREELIST_H_