Verify that heap object iterator stays within page bound.

src/heap/spaces-inl.h

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_HEAP_SPACES_INL_H_
 #define V8_HEAP_SPACES_INL_H_
 
 #include "src/heap/spaces.h"
 #include "src/heap-profiler.h"
 #include "src/isolate.h"
@@ skipping 73 matching lines @@
 HeapObject* HeapObjectIterator::FromCurrentPage() {
   while (cur_addr_ != cur_end_) {
     if (cur_addr_ == space_->top() && cur_addr_ != space_->limit()) {
       cur_addr_ = space_->limit();
       continue;
     }
     HeapObject* obj = HeapObject::FromAddress(cur_addr_);
     int obj_size = (size_func_ == NULL) ? obj->Size() : size_func_(obj);
     cur_addr_ += obj_size;
     DCHECK(cur_addr_ <= cur_end_);
+    // TODO(hpayer): Remove the debugging code.
+    if (cur_addr_ > cur_end_) {
+      space_->heap()->isolate()->PushStackTraceAndDie(0xaaaaaaaa, obj, NULL,
+                                                      obj_size);
+    }
+
     if (!obj->IsFiller()) {
       DCHECK_OBJECT_SIZE(obj_size);
       return obj;
     }
   }
   return NULL;
 }
 
 
 // -----------------------------------------------------------------------------
@@ skipping 200 matching lines @@
   Map* map = object->map();
   Heap* heap = object->GetHeap();
   return map == heap->raw_unchecked_free_space_map() ||
          map == heap->raw_unchecked_one_pointer_filler_map() ||
          map == heap->raw_unchecked_two_pointer_filler_map();
 }
 }
 }  // namespace v8::internal
 
 #endif  // V8_HEAP_SPACES_INL_H_