[js weak refs] Expand WeakCell::WeakCellVerify + minor fix

(The bug didn't affect any functionality; we just left detached WeakCells in
inconsistent state.)

BUG=v8:8179

Change-Id: I28f6c27532383b94bdfd746db903096f1dc6f1cc
Reviewed-on: https://chromium-review.googlesource.com/c/1447651Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59255}

src/objects-debug.cc

@@ -1298,13 +1298,30 @@ void WeakCell::WeakCellVerify(Isolate* isolate) {
   CHECK(IsWeakCell());
 
   CHECK(target()->IsJSReceiver() || target()->IsUndefined(isolate));
+
+  CHECK(prev()->IsWeakCell() || prev()->IsUndefined(isolate));
+  if (prev()->IsWeakCell()) {
+    CHECK_EQ(WeakCell::cast(prev())->next(), *this);
+  }
+
   CHECK(next()->IsWeakCell() || next()->IsUndefined(isolate));
   if (next()->IsWeakCell()) {
     CHECK_EQ(WeakCell::cast(next())->prev(), *this);
   }
-  CHECK(prev()->IsWeakCell() || prev()->IsUndefined(isolate));
-  if (prev()->IsWeakCell()) {
-    CHECK_EQ(WeakCell::cast(prev())->next(), *this);
+
+  CHECK_IMPLIES(key()->IsUndefined(isolate),
+                key_list_prev()->IsUndefined(isolate));
+  CHECK_IMPLIES(key()->IsUndefined(isolate),
+                key_list_next()->IsUndefined(isolate));
+
+  CHECK(key_list_prev()->IsWeakCell() || key_list_prev()->IsUndefined(isolate));
+  if (key_list_prev()->IsWeakCell()) {
+    CHECK_EQ(WeakCell::cast(key_list_prev())->key_list_next(), *this);
+  }
+
+  CHECK(key_list_next()->IsWeakCell() || key_list_next()->IsUndefined(isolate));
+  if (key_list_next()->IsWeakCell()) {
+    CHECK_EQ(WeakCell::cast(key_list_next())->key_list_prev(), *this);
   }
 
   CHECK(finalization_group()->IsUndefined(isolate) ||

src/objects/js-weak-refs-inl.h

@@ -172,7 +172,9 @@ Object JSFinalizationGroup::PopClearedCellHoldings(
       Handle<Object> key = handle(weak_cell->key(), isolate);
       Handle<WeakCell> next =
           handle(WeakCell::cast(weak_cell->key_list_next()), isolate);
-      next->set_key_list_prev(weak_cell->key_list_prev());
+      DCHECK_EQ(next->key_list_prev(), *weak_cell);
+      next->set_key_list_prev(ReadOnlyRoots(isolate).undefined_value());
+      weak_cell->set_key_list_next(ReadOnlyRoots(isolate).undefined_value());
       key_map = ObjectHashTable::Put(key_map, key, next);
       finalization_group->set_key_map(*key_map);
     } else {

test/cctest/test-js-weak-refs.cc

@@ -406,9 +406,9 @@ TEST(TestJSFinalizationGroupPopClearedCellHoldings2) {
                            *weak_cell1);
   }
 
-  Object cleared2 =
+  Object cleared1 =
       JSFinalizationGroup::PopClearedCellHoldings(finalization_group, isolate);
-  CHECK_EQ(cleared2, *holdings2);
+  CHECK_EQ(cleared1, *holdings2);
 
   {
     Handle<ObjectHashTable> key_map =
@@ -416,9 +416,9 @@ TEST(TestJSFinalizationGroupPopClearedCellHoldings2) {
     VerifyWeakCellKeyChain(isolate, key_map->Lookup(key1), 1, *weak_cell1);
   }
 
-  Object cleared3 =
+  Object cleared2 =
       JSFinalizationGroup::PopClearedCellHoldings(finalization_group, isolate);
-  CHECK_EQ(cleared3, *holdings1);
+  CHECK_EQ(cleared2, *holdings1);
 
   {
     Handle<ObjectHashTable> key_map =