v8:3539 - hold constructor feedback in weak cells

src/type-info.cc

Index: src/type-info.cc
diff --git a/src/type-info.cc b/src/type-info.cc
index 087e1db148b22f2c9943571ebde21d3223656c4a..040e25ecf4e5178382a4578f8b061d2e84ec3024 100644
--- a/src/type-info.cc
+++ b/src/type-info.cc
@@ -51,7 +51,19 @@ Handle<Object> TypeFeedbackOracle::GetInfo(TypeFeedbackId ast_id) {
 
 Handle<Object> TypeFeedbackOracle::GetInfo(FeedbackVectorSlot slot) {
   DCHECK(slot.ToInt() >= 0 && slot.ToInt() < feedback_vector_->length());
+  Handle<Object> undefined =
+      Handle<Object>::cast(isolate()->factory()->undefined_value());
   Object* obj = feedback_vector_->Get(slot);
+
+  // Slots do not embed direct pointers to functions. Instead a WeakCell is
+  // always used.
+  DCHECK(!obj->IsJSFunction());
+  if (obj->IsWeakCell()) {
+    WeakCell* cell = WeakCell::cast(obj);
+    if (cell->cleared()) return undefined;
+    obj = cell->value();
+  }
+
   return Handle<Object>(obj, isolate());
 }