Make accessors for oddball objects return Oddball* instead of Object*.

src/objects.cc

Index: src/objects.cc
===================================================================
--- src/objects.cc	(revision 9511)
+++ src/objects.cc	(working copy)
@@ -545,7 +545,9 @@
   // holder in the prototype chain.
   // Proxy handlers do not use the proxy's prototype, so we can skip this.
   if (!result->IsHandler()) {
-    Object* last = result->IsProperty() ? result->holder() : heap->null_value();
+    Object* last = result->IsProperty()
+        ? result->holder()
+        : Object::cast(heap->null_value());
     ASSERT(this != this->GetPrototype());
     for (Object* current = this; true; current = current->GetPrototype()) {
       if (current->IsAccessCheckNeeded()) {