Track up to 5 stable maps as field type.

src/objects-debug.cc

Index: src/objects-debug.cc
diff --git a/src/objects-debug.cc b/src/objects-debug.cc
index 40132cbf6b050f5da85ce18b2dcf02184f512615..aa826141244413cdff2b3d0a362a5ed9153e5e19 100644
--- a/src/objects-debug.cc
+++ b/src/objects-debug.cc
@@ -300,13 +300,10 @@ void JSObject::JSObjectVerify() {
         if (r.IsSmi()) ASSERT(value->IsSmi());
         if (r.IsHeapObject()) ASSERT(value->IsHeapObject());
         HeapType* field_type = descriptors->GetFieldType(i);
-        if (field_type->IsClass()) {
-          Map* map = *field_type->AsClass()->Map();
-          CHECK(!map->is_stable() || HeapObject::cast(value)->map() == map);
-        } else if (r.IsNone()) {
+        if (r.IsNone()) {
           CHECK(field_type->Is(HeapType::None()));
-        } else {
-          CHECK(HeapType::Any()->Is(field_type));
+        } else if (!HeapType::Any()->Is(field_type)) {
+          CHECK(!field_type->NowStable() || field_type->NowContains(value));
         }
       }
     }