The old code was adding a size in words to a byte*. Should use size in
bytes. Also, the assertions were doing signed comparisons on pointers
instead of unsigned. Fixing the assertions makes one of the assertions
identical to the condition just before it.

R=fschneider@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7468024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8704 ce2b1a6d-e550-0410-aec6-3dcde31c8c00