Deletion barrier preparation: validate overwritten references.

runtime/vm/pages.cc

Index: runtime/vm/pages.cc
===================================================================
--- runtime/vm/pages.cc	(revision 42249)
+++ runtime/vm/pages.cc	(working copy)
@@ -876,6 +876,28 @@
 }
 
 
+uword PageSpace::TryAllocateSmiInitializedLocked(intptr_t size,
+                                                 GrowthPolicy growth_policy) {
+  uword result = TryAllocateDataBumpLocked(size, growth_policy);
+  if (collections() != 0) {
+#if defined(DEBUG)
+    FATAL1("%" Pd " GCs before TryAllocateSmiInitializedLocked", collections());
+#else
+    // Shouldn't happen, but prefer slight slowdown over (exploitable?) crash.

[Ivan Posva, 2015/01/02 17:09:39]

FATAL should better not be exploitable. We "reach" it in many other situations.

In this case I would prefer if we did not allow to get into this situation even
in release mode.

[koda, 2015/01/02 17:30:53]

Done.

+    memset(reinterpret_cast<void*>(result), 0, size);
+#endif  // DEBUG
+  }
+#if defined(DEBUG)
+  RawObject** begin = reinterpret_cast<RawObject**>(result);
+  RawObject** end = reinterpret_cast<RawObject**>(result + size);
+  for (RawObject** current = begin; current < end; ++current) {
+    ASSERT(!(*current)->IsHeapObject());
+  }
+#endif
+  return result;
+}
+
+
 PageSpaceController::PageSpaceController(Heap* heap,
                                          int heap_growth_ratio,
                                          int heap_growth_max,
@@ -1001,8 +1023,8 @@
     return 0;
   } else {
     ASSERT(total_time >= gc_time);
-    int result= static_cast<int>((static_cast<double>(gc_time) /
-                             static_cast<double>(total_time)) * 100);
+    int result = static_cast<int>((static_cast<double>(gc_time) /
+                                   static_cast<double>(total_time)) * 100);
     return result;
   }
 }