Object.oberve: assertions to narrow down flaky crashes with array length mutation.

src/objects-debug.cc

Index: src/objects-debug.cc
diff --git a/src/objects-debug.cc b/src/objects-debug.cc
index e3226c18b8208061d73f47e79867f373d3583198..5045e1e11773955b8765f38284ed4c87022c75f4 100644
--- a/src/objects-debug.cc
+++ b/src/objects-debug.cc
@@ -311,6 +311,9 @@ void Map::MapVerify() {
     SLOW_ASSERT(transitions()->IsSortedNoDuplicates());
     SLOW_ASSERT(transitions()->IsConsistentWithBackPointers(this));
   }
+  ASSERT(!is_observed() || instance_type() < FIRST_JS_OBJECT_TYPE ||
+         instance_type() > LAST_JS_OBJECT_TYPE ||
+         has_slow_elements_kind() || has_external_array_elements());
 }