For HashTable-backed JS objects, use the proper type in the table() accessor

src/objects-debug.cc

Index: src/objects-debug.cc
diff --git a/src/objects-debug.cc b/src/objects-debug.cc
index 60463684999001b779eef13970299db1d6a3ed08..0fd9f7dfbab97fe369b3447bec35a5b0ac73d415 100644
--- a/src/objects-debug.cc
+++ b/src/objects-debug.cc
@@ -623,24 +623,32 @@ void JSArray::JSArrayVerify() {
 void JSSet::JSSetVerify() {
   CHECK(IsJSSet());
   JSObjectVerify();
-  VerifyHeapPointer(table());
-  CHECK(table()->IsHashTable() || table()->IsUndefined());
+  VerifyObjectField(kTableOffset);
+  Object* table = *RawField(this, kTableOffset);
+  CHECK(table->IsHashTable() || table->IsUndefined());
 }
 
 
 void JSMap::JSMapVerify() {
   CHECK(IsJSMap());
   JSObjectVerify();
-  VerifyHeapPointer(table());
-  CHECK(table()->IsHashTable() || table()->IsUndefined());
+  VerifyObjectField(kTableOffset);
+  Object* table = *RawField(this, kTableOffset);
+  CHECK(table->IsHashTable() || table->IsUndefined());
 }
 
 
 void JSWeakMap::JSWeakMapVerify() {
   CHECK(IsJSWeakMap());
   JSObjectVerify();
-  VerifyHeapPointer(table());
-  CHECK(table()->IsHashTable() || table()->IsUndefined());
+  VerifyObjectField(kTableOffset);
+  VerifyObjectField(kNextOffset);
+  Object* table = *RawField(this, kTableOffset);
+  CHECK(table->IsHashTable() || table->IsUndefined());
+  if (next()->IsSmi())
+    CHECK_EQ(0, Smi::cast(next())->value());
+  else
+    CHECK(next()->IsJSWeakMap() || next()->IsUndefined());
 }