Add mistagging-readbarrier to weak cell

src/objects.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_OBJECTS_H_
 #define V8_OBJECTS_H_
 
 #include <iosfwd>
 
 #include "src/allocation.h"
@@ skipping 9696 matching lines @@
                               kSize> BodyDescriptor;
 
  private:
   DECL_ACCESSORS(type_raw, Object)
   DISALLOW_IMPLICIT_CONSTRUCTORS(PropertyCell);
 };
 
 
 class WeakCell : public HeapObject {
  public:
-  inline Object* value() const;
+  inline Object* value();
+  inline Object* ValueNoReadBarrier();
 
   // This should not be called by anyone except GC.
   inline void clear();
 
   // This should not be called by anyone except allocator.
   inline void initialize(HeapObject* value);
 
   inline bool cleared() const;
 
   DECL_ACCESSORS(next, Object)
 
   DECLARE_CAST(WeakCell)
 
   DECLARE_PRINTER(WeakCell)
   DECLARE_VERIFIER(WeakCell)
 
   // Layout description.
-  static const int kValueOffset = HeapObject::kHeaderSize;
-  static const int kNextOffset = kValueOffset + kPointerSize;
+  static const int kValueOffsetDontForgetTheReadBarrier =
+      HeapObject::kHeaderSize;
+  static const int kNextOffset =
+      kValueOffsetDontForgetTheReadBarrier + kPointerSize;
   static const int kSize = kNextOffset + kPointerSize;
 
-  typedef FixedBodyDescriptor<kValueOffset, kSize, kSize> BodyDescriptor;
+  typedef FixedBodyDescriptor<kValueOffsetDontForgetTheReadBarrier, kSize,
+                              kSize> BodyDescriptor;
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(WeakCell);
 };
 
 
 // The JSProxy describes EcmaScript Harmony proxies
 class JSProxy: public JSReceiver {
  public:
   // [handler]: The handler property.
@@ skipping 1178 matching lines @@
     } else {
       value &= ~(1 << bit_position);
     }
     return value;
   }
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_OBJECTS_H_