Fast-to-slow migration should wipe out in-object space if it exists in the object after migration.

src/objects-inl.h

Index: src/objects-inl.h
diff --git a/src/objects-inl.h b/src/objects-inl.h
index 03aea64736d818f456c748f76a31d583593dc664..07354937a0e55724241d395b89372f1a33e5ec74 100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -5331,7 +5331,7 @@ void Map::AppendDescriptor(Descriptor* desc) {
 
 Object* Map::GetBackPointer() {
   Object* object = READ_FIELD(this, kTransitionsOrBackPointerOffset);
-  if (object->IsDescriptorArray()) {
+  if (object->IsTransitionArray()) {
     return TransitionArray::cast(object)->back_pointer_storage();
   } else {
     DCHECK(object->IsMap() || object->IsUndefined());