Make JSFunction::BodyDescriptor the only single place that knows how to iterate JSFunction's body.

src/profiler/heap-snapshot-generator.cc

Index: src/profiler/heap-snapshot-generator.cc
diff --git a/src/profiler/heap-snapshot-generator.cc b/src/profiler/heap-snapshot-generator.cc
index e37f03df1b00394eaa99625c3a987b930ceb4c1b..2268db223f27a9083f06105154a7e02f3bd5449e 100644
--- a/src/profiler/heap-snapshot-generator.cc
+++ b/src/profiler/heap-snapshot-generator.cc
@@ -1158,8 +1158,11 @@ void V8HeapExplorer::ExtractJSObjectReferences(
     SetWeakReference(js_fun, entry,
                      "next_function_link", js_fun->next_function_link(),
                      JSFunction::kNextFunctionLinkOffset);
-    STATIC_ASSERT(JSFunction::kNextFunctionLinkOffset
-                 == JSFunction::kNonWeakFieldsEndOffset);
+    // Ensure no new weak references appeared in JSFunction.
+    STATIC_ASSERT(JSFunction::kCodeEntryOffset ==
+                  JSFunction::kNonWeakFieldsEndOffset);
+    STATIC_ASSERT(JSFunction::kCodeEntryOffset + kPointerSize ==
+                  JSFunction::kNextFunctionLinkOffset);
     STATIC_ASSERT(JSFunction::kNextFunctionLinkOffset + kPointerSize
                  == JSFunction::kSize);
   } else if (obj->IsJSGlobalObject()) {