Add debug checks to catch crashes with WeakCell::cast().

src/transitions.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_TRANSITIONS_H_
 #define V8_TRANSITIONS_H_
 
 #include "src/checks.h"
 #include "src/elements-kind.h"
 #include "src/heap/heap.h"
@@ skipping 50 matching lines @@
   }
   static inline bool IsSimpleTransition(Object* raw_transition) {
     DCHECK(!raw_transition->IsWeakCell() ||
            WeakCell::cast(raw_transition)->cleared() ||
            WeakCell::cast(raw_transition)->value()->IsMap());
     return raw_transition->IsWeakCell() &&
            !WeakCell::cast(raw_transition)->cleared();
   }
   static inline Map* GetSimpleTransition(Object* raw_transition) {
     DCHECK(IsSimpleTransition(raw_transition));
+    DCHECK(raw_transition->IsWeakCell());
     return Map::cast(WeakCell::cast(raw_transition)->value());
   }
   static inline bool IsFullTransitionArray(Object* raw_transitions) {
     return raw_transitions->IsTransitionArray();
   }
 
   // The size of transition arrays are limited so they do not end up in large
   // object space. Otherwise ClearNonLiveReferences would leak memory while
   // applying in-place right trimming.
   static bool CanHaveMoreTransitions(Handle<Map> map);
@@ skipping 217 matching lines @@
                                                Object* transitions);
 #endif
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(TransitionArray);
 };
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_TRANSITIONS_H_