[ubsan] Fix HeapObjectMatcher to avoid invalid casts.

test/unittests/compiler/js-type-feedback-unittest.cc

Index: test/unittests/compiler/js-type-feedback-unittest.cc
diff --git a/test/unittests/compiler/js-type-feedback-unittest.cc b/test/unittests/compiler/js-type-feedback-unittest.cc
index 524ea6e6c77bab6906ac7fbfc4c8bd32ad26fa9c..07e26b66eebaae26c522877648e20d2f0384aae6 100644
--- a/test/unittests/compiler/js-type-feedback-unittest.cc
+++ b/test/unittests/compiler/js-type-feedback-unittest.cc
@@ -275,7 +275,7 @@ TEST_F(JSTypeFeedbackTest, JSLoadNamedGlobalPropertyCellSmiWithDeoptimization) {
       access, CaptureEq(&cell_capture), graph()->start(), graph()->start());
   EXPECT_THAT(r.replacement(), load_field_match);
 
-  HeapObjectMatcher<PropertyCell> cell(cell_capture.value());
+  HeapObjectMatcher cell(cell_capture.value());
   EXPECT_TRUE(cell.HasValue());
   EXPECT_TRUE(cell.Value().handle()->IsPropertyCell());
 
@@ -327,7 +327,7 @@ TEST_F(JSTypeFeedbackTest,
       access, CaptureEq(&cell_capture), graph()->start(), graph()->start());
   EXPECT_THAT(r.replacement(), load_field_match);
 
-  HeapObjectMatcher<PropertyCell> cell(cell_capture.value());
+  HeapObjectMatcher cell(cell_capture.value());
   EXPECT_TRUE(cell.HasValue());
   EXPECT_TRUE(cell.Value().handle()->IsPropertyCell());