[in-place weak refs] Fix: allow weak array types in large object space.

BUG=v8:7308,chromium:839953

Change-Id: I3738dc8169730763a587a2452421a54aff11e38e
Reviewed-on: https://chromium-review.googlesource.com/1046645
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53016}

src/heap/spaces.cc

@@ -3472,14 +3472,11 @@ void LargeObjectSpace::Verify() {
     CHECK(heap()->map_space()->Contains(map) ||
           heap()->read_only_space()->Contains(map));
 
-    // We have only code, sequential strings, external strings (sequential
-    // strings that have been morphed into external strings), thin strings
-    // (sequential strings that have been morphed into thin strings), fixed
-    // arrays, fixed double arrays, byte arrays, feedback vectors, bigints and
-    // free space (right after allocation) in the large object space.
+    // We have only the following types in the large object space:
     CHECK(object->IsAbstractCode() || object->IsSeqString() ||
           object->IsExternalString() || object->IsThinString() ||
           object->IsFixedArray() || object->IsFixedDoubleArray() ||
+          object->IsWeakFixedArray() || object->IsWeakArrayList() ||
           object->IsPropertyArray() || object->IsByteArray() ||
           object->IsFeedbackVector() || object->IsBigInt() ||
           object->IsFreeSpace());

test/mjsunit/regress/regress-839953.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --verify-heap
+
+var code = '';
+for (let i = 0; i < 1 << 16; i++) {
+  code += 'x' + i + '= function() {};\n';
+}
+eval(code);