Fix too restrictive check in Map::MapVerify

Bug: chromium:1025468, chromium:1028396
Change-Id: I76f75b4137e2c166a1f89fd9f2e88330281c7625
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1936467Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65169}

src/diagnostics/objects-debug.cc

@@ -458,12 +458,13 @@ void Map::MapVerify(Isolate* isolate) {
           CHECK(!parent.owns_descriptors());
         } else {
           CHECK_EQ(NumberOfOwnDescriptors(), parent.NumberOfOwnDescriptors());
-          // Descriptors sharing through special transitions takes over
+          // Descriptors sharing through special transitions properly takes over
           // ownership from the parent map unless it uses the canonical empty
           // descriptor array.
-          CHECK_IMPLIES(
-              descriptors != ReadOnlyRoots(isolate).empty_descriptor_array(),
-              !parent.owns_descriptors());
+          if (descriptors != ReadOnlyRoots(isolate).empty_descriptor_array()) {
+            CHECK_IMPLIES(owns_descriptors(), !parent.owns_descriptors());
+            CHECK_IMPLIES(parent.owns_descriptors(), !owns_descriptors());
+          }
         }
       }
     }

test/mjsunit/regress/regress-crbug-1028396.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+(function () {
+  var GeneratorFunction = function* () {}.constructor;
+  class MyFunc extends GeneratorFunction {
+    constructor(...args) {
+      super(...args);
+      this.o = {};
+      this.o = {};
+    }
+  }
+  var f = new MyFunc("'use strict'; yield 153;");
+  gc();
+  var f = new MyFunc("'use strict'; yield 153;");
+})();