Catch corrupted pointers earlier.

runtime/vm/scavenger.cc

 // Copyright (c) 2011, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/scavenger.h"
 
 #include <algorithm>
 #include <map>
 #include <utility>
 
@@ skipping 138 matching lines @@
     BoolScope bs(&in_scavenge_pointer_, true);
 #endif
 
     RawObject* raw_obj = *p;
 
     if (raw_obj->IsSmiOrOldObject()) {
       return;
     }
 
     // Objects should be contained in the heap.
     // TODO(iposva): Add an appropriate assert here or in the return block

[Ivan Posva, 2015/03/02 18:38:48]

Aren't you addressing this TODO with the assertion below?

[koda, 2015/03/02 19:06:25]

Done.

     // below.
 
     // The scavenger is only interested in objects located in the from space.
     //
     // We are using address math here and relying on the unsigned underflow
     // in the code below to avoid having two checks.
     uword obj_offset = reinterpret_cast<uword>(raw_obj) - from_start_;
     if (obj_offset > from_size_) {
+      ASSERT(scavenger_->to_->Contains(RawObject::ToAddr(raw_obj)));
       return;
     }
 
     uword raw_addr = RawObject::ToAddr(raw_obj);
     // Read the header word of the object and determine if the object has
     // already been copied.
     uword header = *reinterpret_cast<uword*>(raw_addr);
     uword new_addr = 0;
     if (IsForwarding(header)) {
       // Get the new location of the object.
@@ skipping 725 matching lines @@
 }
 
 
 void Scavenger::FreeExternal(intptr_t size) {
   ASSERT(size >= 0);
   external_size_ -= size;
   ASSERT(external_size_ >= 0);
 }
 
 }  // namespace dart