The Elements pointer in a JSObject can have a filler map instead of a

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 267ef133abc43373b84b02fbd9c3e8e63b2ce85a..6a94edd93fc88c47d4a1a1b474072d1731dd8561 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -2590,6 +2590,11 @@ class JSObject: public JSReceiver {
   };
 
   void IncrementSpillStatistics(SpillInformation* info);
+
+  // If a GC was caused while constructing this object, the elements pointer
+  // may point to a one pointer filler map. The object won't be rooted, but
+  // our heap verification code could stumble across it.
+  bool ElementsAreSafeToExamine();
 #endif
   Object* SlowReverseLookup(Object* value);