[field type tracking] Fix handling of cleared WeakCells

src/lookup.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/lookup.h"
 
 #include "src/bootstrapper.h"
 #include "src/deoptimizer.h"
 #include "src/isolate-inl.h"
 #include "src/lookup-inl.h"
@@ skipping 160 matching lines @@
     JSObject::SetNormalizedProperty(holder, name(), value, details);
   } else {
     holder_map_ = Map::ReconfigureExistingProperty(
         holder_map_, descriptor_number(), i::kData, attributes);
     holder_map_ =
         Map::PrepareForDataProperty(holder_map_, descriptor_number(), value);
     JSObject::MigrateToMap(holder, holder_map_);
   }
 
   ReloadPropertyInformation();
+  WriteDataValue(value);
+
+#if VERIFY_HEAP
+  if (FLAG_verify_heap) {
+    holder->JSObjectVerify();
+  }
+#endif
 }
 
 
 void LookupIterator::PrepareTransitionToDataProperty(
     Handle<Object> value, PropertyAttributes attributes,
     Object::StoreFromKeyed store_mode) {
   if (state_ == TRANSITION) return;
   DCHECK(state_ != LookupIterator::ACCESSOR ||
          (GetAccessors()->IsAccessorInfo() &&
           AccessorInfo::cast(*GetAccessors())->is_special_data_property()));
@@ skipping 92 matching lines @@
     } else {
       pair = AccessorPair::Copy(pair);
       pair->set(component, *accessor);
     }
   } else {
     pair = factory()->NewAccessorPair();
     pair->set(component, *accessor);
   }
 
   TransitionToAccessorPair(pair, attributes);
+
+#if VERIFY_HEAP
+  if (FLAG_verify_heap) {
+    receiver->JSObjectVerify();
+  }
+#endif
 }
 
 
 void LookupIterator::TransitionToAccessorPair(Handle<Object> pair,
                                               PropertyAttributes attributes) {
   Handle<JSObject> receiver = GetStoreTarget();
   holder_ = receiver;
 
   PropertyDetails details(attributes, ACCESSOR_CONSTANT, 0,
                           PropertyCellType::kMutable);
@@ skipping 240 matching lines @@
       case InterceptorState::kSkipNonMasking:
         return true;
       case InterceptorState::kProcessNonMasking:
         return false;
     }
   }
   return interceptor_state_ == InterceptorState::kProcessNonMasking;
 }
 }  // namespace internal
 }  // namespace v8