Enhance raw object validation check and enable checks in release builds.

runtime/vm/raw_object.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/raw_object.h"
 
 #include "vm/class_table.h"
 #include "vm/freelist.h"
 #include "vm/isolate.h"
 #include "vm/object.h"
 #include "vm/visitor.h"
 
 
 namespace dart {
 
 void RawObject::Validate(Isolate* isolate) const {
-  // Validation only happens in DEBUG builds.
-#if defined(DEBUG)
   if (Object::null_class_ == reinterpret_cast<RawClass*>(kHeapObjectTag)) {
     // Validation relies on properly initialized class classes. Skip if the
     // VM is still being initialized.
     return;
   }
   // All Smi values are valid.
   if (!IsHeapObject()) {
     return;
   }
   // Validate that the tags_ field is sensible.
   uword tags = ptr()->tags_;
-  ASSERT((tags & 0x000000f0) == 0);
-#endif
+  uword reserved = 0;
+  reserved |= (1 << kReservedBit10K);
+  reserved |= (1 << kReservedBit100K);
+  reserved |= (1 << kReservedBit1M);
+  reserved |= (1 << kReservedBit10M);
+  if ((tags & reserved) != 0) {
+    FATAL1("Invalid tags field encountered %#lx\n", tags);
+  }
+  intptr_t class_id = ClassIdTag::decode(tags);
+  if (!isolate->class_table()->IsValidIndex(class_id)) {
+    FATAL1("Invalid class id encountered %d\n", class_id);
+  }
+  intptr_t size = SizeTag::decode(tags);
+  if (size != 0 && size != SizeFromClass()) {
+    FATAL1("Inconsistent class size encountered %d\n", size);
+  }
 }
 
 
 intptr_t RawObject::SizeFromClass() const {
   Isolate* isolate = Isolate::Current();
   NoHandleScope no_handles(isolate);
 
   // Only reasonable to be called on heap objects.
   ASSERT(IsHeapObject());
 
@@ skipping 899 matching lines @@
 intptr_t RawJSRegExp::VisitJSRegExpPointers(RawJSRegExp* raw_obj,
                                             ObjectPointerVisitor* visitor) {
   // Make sure that we got here with the tagged pointer as this.
   ASSERT(raw_obj->IsHeapObject());
   intptr_t length = Smi::Value(raw_obj->ptr()->data_length_);
   visitor->VisitPointers(raw_obj->from(), raw_obj->to());
   return JSRegExp::InstanceSize(length);
 }
 
 }  // namespace dart