Catch corrupted pointers earlier.

runtime/vm/raw_object.h

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #ifndef VM_RAW_OBJECT_H_
 #define VM_RAW_OBJECT_H_
 
 #include "platform/assert.h"
 #include "vm/atomic.h"
 #include "vm/globals.h"
@@ skipping 266 matching lines @@
       return  (size > kMaxSizeTag) ? 0 : (size >> kObjectAlignmentLog2);
     }
     static intptr_t TagValueToSize(intptr_t value) {
       return value << kObjectAlignmentLog2;
     }
   };
 
   class ClassIdTag :
       public BitField<intptr_t, kClassIdTagPos, kClassIdTagSize> {};  // NOLINT
 
+  bool IsWellFormed() const {
+    uword value = reinterpret_cast<uword>(this);
+    return (value & kSmiTagMask) == 0 ||
+        Utils::IsAligned(value - kHeapObjectTag, kWordSize);
+  }
   bool IsHeapObject() const {
+    ASSERT(IsWellFormed());
     uword value = reinterpret_cast<uword>(this);
     return (value & kSmiTagMask) == kHeapObjectTag;
   }
   // Assumes this is a heap object.
   bool IsNewObject() const {
     ASSERT(IsHeapObject());
     uword addr = reinterpret_cast<uword>(this);
     return (addr & kNewObjectAlignmentOffset) == kNewObjectAlignmentOffset;
   }
   // Assumes this is a heap object.
   bool IsOldObject() const {
     ASSERT(IsHeapObject());
     uword addr = reinterpret_cast<uword>(this);
     return (addr & kNewObjectAlignmentOffset) == kOldObjectAlignmentOffset;
   }
   // Assumes this is a heap object.
   bool IsVMHeapObject() const;
 
   // Like !IsHeapObject() || IsOldObject(), but compiles to a single branch.
   bool IsSmiOrOldObject() const {
+    ASSERT(IsWellFormed());
     COMPILE_ASSERT(kHeapObjectTag == 1);
     COMPILE_ASSERT(kNewObjectAlignmentOffset == kWordSize);
     static const uword kNewObjectBits =
         (kNewObjectAlignmentOffset | kHeapObjectTag);
     const uword addr = reinterpret_cast<uword>(this);
     return (addr & kNewObjectBits) != kNewObjectBits;
   }
 
   // Support for GC marking bit.
   bool IsMarked() const {
@@ skipping 1844 matching lines @@
   COMPILE_ASSERT(kExternalTypedDataInt8ArrayCid ==
                  kTypedDataInt8ArrayViewCid + 15);
   COMPILE_ASSERT(kByteBufferCid == kExternalTypedDataInt8ArrayCid + 14);
   COMPILE_ASSERT(kNullCid == kByteBufferCid + 1);
   return (kNullCid - kTypedDataInt8ArrayCid);
 }
 
 }  // namespace dart
 
 #endif  // VM_RAW_OBJECT_H_