Reland "Fix memory leak caused by field type in descriptor array."

src/objects-debug.cc

Index: src/objects-debug.cc
diff --git a/src/objects-debug.cc b/src/objects-debug.cc
index 7e0a747ac7604798847456b8ea80d1ee1fc8f337..4b30e28a94f2229bdad0c2a06000adc5f80b88e8 100644
--- a/src/objects-debug.cc
+++ b/src/objects-debug.cc
@@ -289,9 +289,11 @@ void JSObject::JSObjectVerify() {
         if (r.IsSmi()) DCHECK(value->IsSmi());
         if (r.IsHeapObject()) DCHECK(value->IsHeapObject());
         HeapType* field_type = descriptors->GetFieldType(i);
+        bool type_is_none = field_type->Is(HeapType::None());
+        bool type_is_any = field_type->Is(HeapType::Any());

[Jakob Kummerow, 2015/04/11 12:00:58]

Shouldn't this be the other way round, i.e. HeapType::Any()->Is(field_type) ?
AKAIF "t->Is(Any)" will be true for every type t, whereas "Any->Is(t)" is only
true when t == Any.

         if (r.IsNone()) {
-          CHECK(field_type->Is(HeapType::None()));
-        } else if (!HeapType::Any()->Is(field_type)) {
+          CHECK(type_is_none);
+        } else if (!type_is_any && !(type_is_none && r.IsHeapObject())) {
           CHECK(!field_type->NowStable() || field_type->NowContains(value));
         }
       }