Separate Cell and PropertyCell spaces

src/objects-debug.cc

Index: src/objects-debug.cc
diff --git a/src/objects-debug.cc b/src/objects-debug.cc
index 4008181bad410dcc32881cb571bf2318a316cf1b..46ecf67fa9e56ee14da58fd2c09122bd5a5103ed 100644
--- a/src/objects-debug.cc
+++ b/src/objects-debug.cc
@@ -163,6 +163,9 @@ void HeapObject::HeapObjectVerify() {
     case JS_BUILTINS_OBJECT_TYPE:
       JSBuiltinsObject::cast(this)->JSBuiltinsObjectVerify();
       break;
+    case CELL_TYPE:
+      Cell::cast(this)->CellVerify();
+      break;
     case JS_GLOBAL_PROPERTY_CELL_TYPE:
       JSGlobalPropertyCell::cast(this)->JSGlobalPropertyCellVerify();
       break;
@@ -615,9 +618,16 @@ void Oddball::OddballVerify() {
 }
 
 
+void Cell::CellVerify() {
+  CHECK(IsCell());
+  VerifyObjectField(kValueOffset);
+}
+
+
 void JSGlobalPropertyCell::JSGlobalPropertyCellVerify() {
   CHECK(IsJSGlobalPropertyCell());
   VerifyObjectField(kValueOffset);
+  VerifyObjectField(kTypeOffset);
 }