[ubsan] Fix HeapObjectMatcher to avoid invalid casts.

test/unittests/compiler/js-type-feedback-unittest.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler.h"
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/js-type-feedback.h"
@@ skipping 257 matching lines @@
                        JSTypeFeedbackSpecializer::kDeoptimizationEnabled);
 
   // Check LoadNamed(global) => LoadField[PropertyCell::value](cell)
   ASSERT_TRUE(r.Changed());
   FieldAccess access = AccessBuilder::ForPropertyCellValue();
   Capture<Node*> cell_capture;
   Matcher<Node*> load_field_match = IsLoadField(
       access, CaptureEq(&cell_capture), graph()->start(), graph()->start());
   EXPECT_THAT(r.replacement(), load_field_match);
 
-  HeapObjectMatcher<PropertyCell> cell(cell_capture.value());
+  HeapObjectMatcher cell(cell_capture.value());
   EXPECT_TRUE(cell.HasValue());
   EXPECT_TRUE(cell.Value().handle()->IsPropertyCell());
 
   EXPECT_THAT(ret,
               IsReturn(load_field_match, load_field_match, graph()->start()));
   EXPECT_THAT(graph()->end(), IsEnd(ret));
 
   EXPECT_FALSE(dependencies()->IsEmpty());
   dependencies()->Rollback();
 }
@@ skipping 31 matching lines @@
                        JSTypeFeedbackSpecializer::kDeoptimizationEnabled);
 
   // Check LoadNamed(global) => LoadField[PropertyCell::value](cell)
   ASSERT_TRUE(r.Changed());
   FieldAccess access = AccessBuilder::ForPropertyCellValue();
   Capture<Node*> cell_capture;
   Matcher<Node*> load_field_match = IsLoadField(
       access, CaptureEq(&cell_capture), graph()->start(), graph()->start());
   EXPECT_THAT(r.replacement(), load_field_match);
 
-  HeapObjectMatcher<PropertyCell> cell(cell_capture.value());
+  HeapObjectMatcher cell(cell_capture.value());
   EXPECT_TRUE(cell.HasValue());
   EXPECT_TRUE(cell.Value().handle()->IsPropertyCell());
 
   EXPECT_THAT(ret,
               IsReturn(load_field_match, load_field_match, graph()->start()));
   EXPECT_THAT(graph()->end(), IsEnd(ret));
 
   EXPECT_FALSE(dependencies()->IsEmpty());
   dependencies()->Rollback();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8