Destroyed global handles should not be touched. Added extra...

src/global-handles.cc

 // Copyright 2007-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 78 matching lines @@
     ASSERT(OFFSET_OF(Node, object_) == 0);
     return reinterpret_cast<Node*>(location);
   }
 
   // Returns the handle.
   Handle<Object> handle() { return Handle<Object>(&object_); }
 
   // Make this handle weak.
   void MakeWeak(void* parameter, WeakReferenceCallback callback) {
     LOG(HandleEvent("GlobalHandle::MakeWeak", handle().location()));
+    ASSERT(state_ != DESTROYED);
     if (state_ != WEAK && !IsNearDeath()) {
       GlobalHandles::number_of_weak_handles_++;
       if (object_->IsJSGlobalObject()) {
         GlobalHandles::number_of_global_object_weak_handles_++;
       }
     }
     state_ = WEAK;
     set_parameter(parameter);
     callback_ = callback;
   }
 
   void ClearWeakness() {
     LOG(HandleEvent("GlobalHandle::ClearWeakness", handle().location()));
+    ASSERT(state_ != DESTROYED);
     if (state_ == WEAK || IsNearDeath()) {
       GlobalHandles::number_of_weak_handles_--;
       if (object_->IsJSGlobalObject()) {
         GlobalHandles::number_of_global_object_weak_handles_--;
       }
     }
     state_ = NORMAL;
     set_parameter(NULL);
   }
 
@@ skipping 248 matching lines @@
 
 void GlobalHandles::RemoveObjectGroups() {
   for (int i = 0; i< object_groups_.length(); i++) {
     delete object_groups_[i];
   }
   object_groups_.Clear();
 }
 
 
 } }  // namespace v8::internal