Catch corrupted pointers earlier.

runtime/vm/scavenger.cc

 // Copyright (c) 2011, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/scavenger.h"
 
 #include <algorithm>
 #include <map>
 #include <utility>
 
@@ skipping 137 matching lines @@
     ASSERT(!in_scavenge_pointer_);
     BoolScope bs(&in_scavenge_pointer_, true);
 #endif
 
     RawObject* raw_obj = *p;
 
     if (raw_obj->IsSmiOrOldObject()) {
       return;
     }
 
-    // Objects should be contained in the heap.
-    // TODO(iposva): Add an appropriate assert here or in the return block
-    // below.
-
     // The scavenger is only interested in objects located in the from space.
     //
     // We are using address math here and relying on the unsigned underflow
     // in the code below to avoid having two checks.
     uword obj_offset = reinterpret_cast<uword>(raw_obj) - from_start_;
     if (obj_offset > from_size_) {
+      ASSERT(scavenger_->to_->Contains(RawObject::ToAddr(raw_obj)));
       return;
     }
 
     uword raw_addr = RawObject::ToAddr(raw_obj);
     // Read the header word of the object and determine if the object has
     // already been copied.
     uword header = *reinterpret_cast<uword*>(raw_addr);
     uword new_addr = 0;
     if (IsForwarding(header)) {
       // Get the new location of the object.
@@ skipping 725 matching lines @@
 }
 
 
 void Scavenger::FreeExternal(intptr_t size) {
   ASSERT(size >= 0);
   external_size_ -= size;
   ASSERT(external_size_ >= 0);
 }
 
 }  // namespace dart