Cannot use Handle<T>::cast in Unique<T>::cast since it will try to do a...

Cannot use Handle<T>::cast in Unique<T>::cast since it will try to do a T::cast (and its typecheck) concurrently, which is unsafe concurrently on moving values

BUG=

Review URL: https://codereview.chromium.org/1022943002

Cr-Commit-Position: refs/heads/master@{#27324}

src/bootstrapper.cc

@@ -2772,8 +2772,7 @@ void Genesis::TransferNamedProperties(Handle<JSObject> from,
                                               isolate());
         DCHECK(!value->IsCell());
         if (value->IsPropertyCell()) {
-          value = Handle<Object>(PropertyCell::cast(*value)->value(),
-                                 isolate());
+          value = handle(PropertyCell::cast(*value)->value(), isolate());
         }
         PropertyDetails details = properties->DetailsAt(i);
         DCHECK_EQ(kData, details.kind());

src/lookup.cc

@@ -312,7 +312,7 @@ Handle<PropertyCell> LookupIterator::GetPropertyCell() const {
   Handle<GlobalObject> global = Handle<GlobalObject>::cast(holder);
   Object* value = global->property_dictionary()->ValueAt(dictionary_entry());
   DCHECK(value->IsPropertyCell());
-  return Handle<PropertyCell>(PropertyCell::cast(value));
+  return handle(PropertyCell::cast(value));
 }
 
 

src/lookup.h

@@ -138,10 +138,6 @@ class LookupIterator FINAL BASE_EMBEDDED {
   int GetAccessorIndex() const;
   int GetConstantIndex() const;
   Handle<PropertyCell> GetPropertyCell() const;
-  Handle<PropertyCell> GetTransitionPropertyCell() const {
-    DCHECK_EQ(TRANSITION, state_);
-    return Handle<PropertyCell>::cast(transition_);
-  }
   Handle<Object> GetAccessors() const;
   Handle<Object> GetDataValue() const;
   // Usually returns the value that was passed in, but may perform

src/unique.h

@@ -108,7 +108,12 @@ class Unique {
   }
 
   template <class S> static Unique<T> cast(Unique<S> that) {
-    return Unique<T>(that.raw_address_, Handle<T>::cast(that.handle_));
+    // Allow fetching location() to unsafe-cast the handle. This is necessary
+    // since we can't concurrently safe-cast. Safe-casting requires looking at
+    // the heap which may be moving concurrently to the compiler thread.
+    AllowHandleDereference allow_deref;
+    return Unique<T>(that.raw_address_,
+                     Handle<T>(reinterpret_cast<T**>(that.handle_.location())));
   }
 
   inline bool IsInitialized() const {