[ubsan] Fix HeapObjectMatcher to avoid invalid casts.

src/compiler/js-context-specialization.h

Index: src/compiler/js-context-specialization.h
diff --git a/src/compiler/js-context-specialization.h b/src/compiler/js-context-specialization.h
index f01ac3f9707e702bb15c1299d5a7d57c7901e7d5..1f0c2b817ad3ebcbcf83df508fb6f31414db820c 100644
--- a/src/compiler/js-context-specialization.h
+++ b/src/compiler/js-context-specialization.h
@@ -6,13 +6,16 @@
 #define V8_COMPILER_JS_CONTEXT_SPECIALIZATION_H_
 
 #include "src/compiler/graph-reducer.h"
-#include "src/compiler/js-graph.h"
-#include "src/contexts.h"
 
 namespace v8 {
 namespace internal {
 namespace compiler {
 
+// Forward declarations.
+class JSGraph;
+class JSOperatorBuilder;
+
+
 // Specializes a given JSGraph to a given context, potentially constant folding
 // some {LoadContext} nodes or strength reducing some {StoreContext} nodes.
 class JSContextSpecializer : public AdvancedReducer {
@@ -27,10 +30,17 @@ class JSContextSpecializer : public AdvancedReducer {
   Reduction ReduceJSStoreContext(Node* node);
 
  private:
-  JSGraph* jsgraph_;
+  Isolate* isolate() const;
+  JSOperatorBuilder* javascript() const;
+  JSGraph* jsgraph() const { return jsgraph_; }
+
+  JSGraph* const jsgraph_;
+
+  DISALLOW_COPY_AND_ASSIGN(JSContextSpecializer);
 };
-}
-}
-}  // namespace v8::internal::compiler
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
 
 #endif  // V8_COMPILER_JS_CONTEXT_SPECIALIZATION_H_