Add debug checks to catch crashes with WeakCell::cast().

src/type-feedback-vector.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/ic/ic.h"
 #include "src/ic/ic-state.h"
 #include "src/objects.h"
 #include "src/type-feedback-vector-inl.h"
@@ skipping 417 matching lines @@
   if (feedback->IsFixedArray() || feedback->IsString()) {
     int found = 0;
     if (feedback->IsString()) {
       feedback = GetFeedbackExtra();
     }
     FixedArray* array = FixedArray::cast(feedback);
     // The array should be of the form [<optional name>], then
     // [map, handler, map, handler, ... ]
     DCHECK(array->length() >= 2);
     for (int i = 0; i < array->length(); i += 2) {
+      DCHECK(array->get(i)->IsWeakCell());
       WeakCell* cell = WeakCell::cast(array->get(i));
       if (!cell->cleared()) {
         Map* map = Map::cast(cell->value());
         maps->Add(handle(map, isolate));
         found++;
       }
     }
     return found;
   } else if (feedback->IsWeakCell()) {
     WeakCell* cell = WeakCell::cast(feedback);
     if (!cell->cleared()) {
       Map* map = Map::cast(cell->value());
       maps->Add(handle(map, isolate));
       return 1;
     }
   }
 
   return 0;
 }
 
 
 MaybeHandle<Code> FeedbackNexus::FindHandlerForMap(Handle<Map> map) const {
   Object* feedback = GetFeedback();
   if (feedback->IsFixedArray() || feedback->IsString()) {
     if (feedback->IsString()) {
       feedback = GetFeedbackExtra();
     }
     FixedArray* array = FixedArray::cast(feedback);
     for (int i = 0; i < array->length(); i += 2) {
+      DCHECK(array->get(i)->IsWeakCell());
       WeakCell* cell = WeakCell::cast(array->get(i));
       if (!cell->cleared()) {
         Map* array_map = Map::cast(cell->value());
         if (array_map == *map) {
           Code* code = Code::cast(array->get(i + 1));
           DCHECK(code->kind() == Code::HANDLER);
           return handle(code);
         }
       }
     }
@@ skipping 18 matching lines @@
   int count = 0;
   if (feedback->IsFixedArray() || feedback->IsString()) {
     if (feedback->IsString()) {
       feedback = GetFeedbackExtra();
     }
     FixedArray* array = FixedArray::cast(feedback);
     // The array should be of the form [map, handler, map, handler, ... ].
     // Be sure to skip handlers whose maps have been cleared.
     DCHECK(array->length() >= 2);
     for (int i = 0; i < array->length(); i += 2) {
+      DCHECK(array->get(i)->IsWeakCell());
       WeakCell* cell = WeakCell::cast(array->get(i));
       if (!cell->cleared()) {
         Code* code = Code::cast(array->get(i + 1));
         DCHECK(code->kind() == Code::HANDLER);
         code_list->Add(handle(code));
         count++;
       }
     }
   } else if (feedback->IsWeakCell()) {
     WeakCell* cell = WeakCell::cast(feedback);
@@ skipping 18 matching lines @@
 
 Name* KeyedLoadICNexus::FindFirstName() const {
   Object* feedback = GetFeedback();
   if (feedback->IsString()) {
     return Name::cast(feedback);
   }
   return NULL;
 }
 }
 }  // namespace v8::internal