[heap] Fix ubsan SpaceIterator test

Now ReadOnlySpace is not a Space, it cannot be upcasted to it, so cast
to BaseSpace as well.

Fixes ubsan failure introduced by
https://chromium-review.googlesource.com/c/v8/v8/+/2209060.

Bug: v8:10454
Change-Id: I2936bfd8349377b441be4a6eedf580d91f1c4ee4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2228723
Commit-Queue: Dan Elphick <delphick@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68140}

test/cctest/heap/test-iterators.cc

@@ -8,6 +8,7 @@
 #include "src/heap/combined-heap.h"
 #include "src/heap/heap.h"
 #include "src/heap/read-only-heap.h"
+#include "src/heap/read-only-spaces.h"
 #include "src/objects/heap-object.h"
 #include "src/objects/objects.h"
 #include "src/roots/roots-inl.h"
@@ -110,7 +111,9 @@ TEST(PagedSpaceIterator) {
 TEST(SpaceIterator) {
   auto* const read_only_space = CcTest::read_only_heap()->read_only_space();
   for (SpaceIterator it(CcTest::heap()); it.HasNext();) {
-    CHECK_NE(it.Next(), reinterpret_cast<Space*>(read_only_space));
+    // ReadOnlySpace is not actually a Space but is instead a BaseSpace, but
+    // ensure it's not been inserted incorrectly.
+    CHECK_NE(it.Next(), reinterpret_cast<BaseSpace*>(read_only_space));
   }
 }