Verify that double unboxing is never performed on large objects.

BUG=

Review URL: https://codereview.chromium.org/1214673007

Cr-Commit-Position: refs/heads/master@{#29538}

diff --git a/src/heap/spaces.cc b/src/heap/spaces.cc
index 0806b25..dfaac73 100644 (file)
--- a/src/heap/spaces.cc
+++ b/src/heap/spaces.cc
@@ -3046,6 +3046,11 @@ void LargeObjectSpace::Verify() {
     CHECK(map->IsMap());
     CHECK(heap()->map_space()->Contains(map));
 
+    // Double unboxing in LO space is not allowed. This would break the
+    // lookup mechanism for store and slot buffer entries which use the
+    // page header tag.
+    CHECK(object->ContentType() != HeapObjectContents::kMixedValues);
+
     // We have only code, sequential strings, external strings
     // (sequential strings that have been morphed into external
     // strings), fixed arrays, byte arrays, and constant pool arrays in the