[field type tracking] Fix handling of cleared WeakCells.

src/objects-debug.cc

Index: src/objects-debug.cc
diff --git a/src/objects-debug.cc b/src/objects-debug.cc
index b512c1e9c2f843b8ef2db2cbc21d82107a7eddb4..a05d1e703626b125635e9ce15ea935164545023d 100644
--- a/src/objects-debug.cc
+++ b/src/objects-debug.cc
@@ -301,7 +301,11 @@ void JSObject::JSObjectVerify() {
         if (r.IsNone()) {
           CHECK(type_is_none);
         } else if (!type_is_any && !(type_is_none && r.IsHeapObject())) {
-          CHECK(!field_type->NowStable() || field_type->NowContains(value));
+          // If allocation folding is off then GC could happen during inner
+          // object literal creation and we will end up having and undefined
+          // value that does not match the field type.
+          CHECK(!field_type->NowStable() || field_type->NowContains(value) ||
+                (!FLAG_use_allocation_folding && value->IsUndefined()));
         }
       }
     }