[object-stats] Handle cleared weak values

Bug: v8:7760
Change-Id: I5589b873845d614a4751b12319c61c91aae04a84
Reviewed-on: https://chromium-review.googlesource.com/1070829Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53318}

src/heap/object-stats.cc

@@ -534,6 +534,8 @@ void ObjectStatsCollectorImpl::RecordVirtualJSObjectDetails(JSObject* object) {
 
 static ObjectStats::VirtualInstanceType GetFeedbackSlotType(
     MaybeObject* maybe_obj, FeedbackSlotKind kind, Isolate* isolate) {
+  if (maybe_obj->IsClearedWeakHeapObject())
+    return ObjectStats::FEEDBACK_VECTOR_SLOT_OTHER_TYPE;
   Object* obj = maybe_obj->GetHeapObjectOrSmi();
   switch (kind) {
     case FeedbackSlotKind::kCall: