Add debug checks to catch PropertyCell::cast failures.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1025433002

Cr-Commit-Position: refs/heads/master@{#27309}

src/lookup-inl.h

@@ -62,6 +62,7 @@ LookupIterator::State LookupIterator::LookupInHolder(Map* const map,
         number_ = dict->FindEntry(name_);
         if (number_ == NameDictionary::kNotFound) return NOT_FOUND;
         if (holder->IsGlobalObject()) {
+          DCHECK(dict->ValueAt(number_)->IsPropertyCell());
           PropertyCell* cell = PropertyCell::cast(dict->ValueAt(number_));
           if (cell->value()->IsTheHole()) return NOT_FOUND;
         }

src/lookup.cc

@@ -256,6 +256,7 @@ Handle<Object> LookupIterator::FetchValue() const {
   if (holder_map_->is_dictionary_map()) {
     result = holder->property_dictionary()->ValueAt(number_);
     if (holder_map_->IsGlobalObjectMap()) {
+      DCHECK(result->IsPropertyCell());
       result = PropertyCell::cast(result)->value();
     }
   } else if (property_details_.type() == v8::internal::DATA) {
@@ -310,6 +311,7 @@ Handle<PropertyCell> LookupIterator::GetPropertyCell() const {
   Handle<JSObject> holder = GetHolder<JSObject>();
   Handle<GlobalObject> global = Handle<GlobalObject>::cast(holder);
   Object* value = global->property_dictionary()->ValueAt(dictionary_entry());
+  DCHECK(value->IsPropertyCell());
   return Handle<PropertyCell>(PropertyCell::cast(value));
 }
 

src/objects.cc

@@ -15201,6 +15201,7 @@ Handle<PropertyCell> GlobalObject::EnsurePropertyCell(
                PropertyCellType::kUninitialized ||
            dictionary->DetailsAt(entry).cell_type() ==
                PropertyCellType::kDeleted);
+    DCHECK(dictionary->ValueAt(entry)->IsPropertyCell());
     cell = handle(PropertyCell::cast(dictionary->ValueAt(entry)));
     DCHECK(cell->value()->IsTheHole());
     return cell;
@@ -15817,6 +15818,7 @@ static inline bool IsDeleted(D d, int i) {
     case DictionaryEntryType::kObjects:
       return false;
     case DictionaryEntryType::kCells:
+      DCHECK(d->ValueAt(i)->IsPropertyCell());
       return PropertyCell::cast(d->ValueAt(i))->value()->IsTheHole();
   }
   UNREACHABLE();
@@ -16972,6 +16974,7 @@ Handle<PropertyCell> PropertyCell::InvalidateEntry(
     Handle<NameDictionary> dictionary, int entry) {
   Isolate* isolate = dictionary->GetIsolate();
   // Swap with a copy.
+  DCHECK(dictionary->ValueAt(entry)->IsPropertyCell());
   Handle<PropertyCell> cell(PropertyCell::cast(dictionary->ValueAt(entry)));
   auto new_cell = isolate->factory()->NewPropertyCell();
   new_cell->set_value(cell->value());
@@ -17025,6 +17028,7 @@ Handle<Object> PropertyCell::UpdateCell(Handle<NameDictionary> dictionary,
                                         int entry, Handle<Object> value,
                                         PropertyDetails details) {
   DCHECK(!value->IsTheHole());
+  DCHECK(dictionary->ValueAt(entry)->IsPropertyCell());
   Handle<PropertyCell> cell(PropertyCell::cast(dictionary->ValueAt(entry)));
   const PropertyDetails original_details = dictionary->DetailsAt(entry);
   // Data accesses could be cached in ics or optimized code.

src/runtime/runtime-object.cc

@@ -605,6 +605,7 @@ RUNTIME_FUNCTION(Runtime_KeyedGetProperty) {
             (dictionary->DetailsAt(entry).type() == DATA)) {
           Object* value = dictionary->ValueAt(entry);
           if (!receiver->IsGlobalObject()) return value;
+          DCHECK(value->IsPropertyCell());
           value = PropertyCell::cast(value)->value();
           if (!value->IsTheHole()) return value;
           // If value is the hole (meaning, absent) do the general lookup.