Add debug checks to catch PropertyCell::cast failures.

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <iomanip>
 #include <sstream>
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
@@ skipping 15183 matching lines @@
   DCHECK(!global->HasFastProperties());
   auto dictionary = handle(global->property_dictionary());
   int entry = dictionary->FindEntry(name);
   Handle<PropertyCell> cell;
   if (entry != NameDictionary::kNotFound) {
     // This call should be idempotent.
     DCHECK(dictionary->DetailsAt(entry).cell_type() ==
                PropertyCellType::kUninitialized ||
            dictionary->DetailsAt(entry).cell_type() ==
                PropertyCellType::kDeleted);
+    DCHECK(dictionary->ValueAt(entry)->IsPropertyCell());
     cell = handle(PropertyCell::cast(dictionary->ValueAt(entry)));
     DCHECK(cell->value()->IsTheHole());
     return cell;
   }
   Isolate* isolate = global->GetIsolate();
   cell = isolate->factory()->NewPropertyCell();
   PropertyDetails details(NONE, DATA, 0, PropertyCellType::kUninitialized);
   dictionary = NameDictionary::Add(dictionary, name, cell, details);
   global->set_properties(*dictionary);
   return cell;
@@ skipping 596 matching lines @@
   return dictionary;
 }
 
 
 template <DictionaryEntryType type, typename D>
 static inline bool IsDeleted(D d, int i) {
   switch (type) {
     case DictionaryEntryType::kObjects:
       return false;
     case DictionaryEntryType::kCells:
+      DCHECK(d->ValueAt(i)->IsPropertyCell());
       return PropertyCell::cast(d->ValueAt(i))->value()->IsTheHole();
   }
   UNREACHABLE();
   return false;
 }
 
 
 template <typename Derived, typename Shape, typename Key>
 template <DictionaryEntryType type>
 int Dictionary<Derived, Shape, Key>::NumberOfElementsFilterAttributes(
@@ skipping 1135 matching lines @@
   }
   Handle<JSTypedArray> self(this);
   return MaterializeArrayBuffer(self);
 }
 
 
 Handle<PropertyCell> PropertyCell::InvalidateEntry(
     Handle<NameDictionary> dictionary, int entry) {
   Isolate* isolate = dictionary->GetIsolate();
   // Swap with a copy.
+  DCHECK(dictionary->ValueAt(entry)->IsPropertyCell());
   Handle<PropertyCell> cell(PropertyCell::cast(dictionary->ValueAt(entry)));
   auto new_cell = isolate->factory()->NewPropertyCell();
   new_cell->set_value(cell->value());
   dictionary->ValueAtPut(entry, *new_cell);
   bool is_the_hole = cell->value()->IsTheHole();
   // Cell is officially mutable henceforth.
   auto details = dictionary->DetailsAt(entry);
   details = details.set_cell_type(is_the_hole ? PropertyCellType::kDeleted
                                               : PropertyCellType::kMutable);
   dictionary->DetailsAtPut(entry, details);
@@ skipping 33 matching lines @@
   }
   UNREACHABLE();
   return PropertyCellType::kMutable;
 }
 
 
 Handle<Object> PropertyCell::UpdateCell(Handle<NameDictionary> dictionary,
                                         int entry, Handle<Object> value,
                                         PropertyDetails details) {
   DCHECK(!value->IsTheHole());
+  DCHECK(dictionary->ValueAt(entry)->IsPropertyCell());
   Handle<PropertyCell> cell(PropertyCell::cast(dictionary->ValueAt(entry)));
   const PropertyDetails original_details = dictionary->DetailsAt(entry);
   // Data accesses could be cached in ics or optimized code.
   bool invalidate =
       original_details.kind() == kData && details.kind() == kAccessor;
   int index = original_details.dictionary_index();
   auto old_type = original_details.cell_type();
   // Preserve the enumeration index unless the property was deleted or never
   // initialized.
   if (cell->value()->IsTheHole()) {
@@ skipping 41 matching lines @@
                                                CompilationInfo* info) {
   Handle<DependentCode> codes = DependentCode::InsertCompilationInfo(
       handle(cell->dependent_code(), info->isolate()),
       DependentCode::kPropertyCellChangedGroup, info->object_wrapper());
   if (*codes != cell->dependent_code()) cell->set_dependent_code(*codes);
   info->dependencies(DependentCode::kPropertyCellChangedGroup)->Add(
       cell, info->zone());
 }
 
 } }  // namespace v8::internal