JSArrayVerify() benefits from an extra check

We already have an implication check that if the ElementsKind
is double, then the elements backing store should be a
FixedDoubleArray. Additionally check that if the ElementsKind is
object or smi, that the backing store is a FixedArray.

R=neis@chromium.org

Bug: v8:8662
Change-Id: Ib01079251fe7e1f1c076d4814ef5d306bb179ef0
Reviewed-on: https://chromium-review.googlesource.com/c/1434234Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59072}

src/objects-debug.cc

@@ -1236,6 +1236,7 @@ void JSArray::JSArrayVerify(Isolate* isolate) {
   if (length()->IsSmi() && HasFastElements()) {
     if (elements()->length() > 0) {
       CHECK_IMPLIES(HasDoubleElements(), elements()->IsFixedDoubleArray());
+      CHECK_IMPLIES(HasSmiOrObjectElements(), elements()->IsFixedArray());
     }
     int size = Smi::ToInt(length());
     // Holey / Packed backing stores might have slack or might have not been