Fix GC-induced DCHECK failure in Runtime_GetWeakMapEntries

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1091253002

Cr-Commit-Position: refs/heads/master@{#27921}

src/runtime/runtime-collections.cc

@@ -266,6 +266,11 @@ RUNTIME_FUNCTION(Runtime_GetWeakMapEntries) {
   }
   Handle<FixedArray> entries =
       isolate->factory()->NewFixedArray(max_entries * 2);
+  // Allocation can cause GC can delete weak elements. Reload.
+  if (max_entries > table->NumberOfElements()) {
+    max_entries = table->NumberOfElements();
+  }
+
   {
     DisallowHeapAllocation no_gc;
     int count = 0;