Do not use out of range visitor ids.

src/heap/objects-visiting.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_OBJECTS_VISITING_H_
 #define V8_OBJECTS_VISITING_H_
 
 #include "src/allocation.h"
 #include "src/layout-descriptor.h"
 
@@ skipping 112 matching lines @@
                                        bool has_unboxed_fields) {
     DCHECK((base == kVisitDataObject) || (base == kVisitStruct) ||
            (base == kVisitJSObject));
     DCHECK(IsAligned(object_size, kPointerSize));
     DCHECK(kMinObjectSizeInWords * kPointerSize <= object_size);
     DCHECK(object_size <= Page::kMaxRegularHeapObjectSize);
     DCHECK(!has_unboxed_fields || (base == kVisitJSObject));
 
     if (has_unboxed_fields) return generic;
 
-    const VisitorId specialization = static_cast<VisitorId>(
-        base + (object_size >> kPointerSizeLog2) - kMinObjectSizeInWords);
+    int visitor_id =
+        Min(base + (object_size >> kPointerSizeLog2) - kMinObjectSizeInWords,
+            static_cast<int>(generic));
 
-    return Min(specialization, generic);
+    return static_cast<VisitorId>(visitor_id);
   }
 };
 
 
 template <typename Callback>
 class VisitorDispatchTable {
  public:
   void CopyFrom(VisitorDispatchTable* other) {
     // We are not using memcpy to guarantee that during update
     // every element of callbacks_ array will remain correct
@@ skipping 339 matching lines @@
 // the next element. Given the head of the list, this function removes dead
 // elements from the list and if requested records slots for next-element
 // pointers. The template parameter T is a WeakListVisitor that defines how to
 // access the next-element pointers.
 template <class T>
 Object* VisitWeakList(Heap* heap, Object* list, WeakObjectRetainer* retainer);
 }
 }  // namespace v8::internal
 
 #endif  // V8_OBJECTS_VISITING_H_