Add map-based read barrier to WeakCell

src/type-info.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/ast.h"
 #include "src/code-stubs.h"
 #include "src/compiler.h"
 #include "src/ic/ic.h"
@@ skipping 53 matching lines @@
   DCHECK(slot.ToInt() >= 0 && slot.ToInt() < feedback_vector_->length());
   Handle<Object> undefined =
       Handle<Object>::cast(isolate()->factory()->undefined_value());
   Object* obj = feedback_vector_->Get(slot);
 
   // Vector-based ICs do not embed direct pointers to maps, functions.
   // Instead a WeakCell is always used.
   if (obj->IsWeakCell()) {
     WeakCell* cell = WeakCell::cast(obj);
     if (cell->cleared()) return undefined;
-    obj = cell->value();
+    obj = cell->value(isolate()->heap());
   }
 
   if (!obj->IsJSFunction() ||
       !CanRetainOtherContext(JSFunction::cast(obj), *native_context_)) {
     return Handle<Object>(obj, isolate());
   }
   return undefined;
 }
 
 
@@ skipping 477 matching lines @@
          UnseededNumberDictionary::kNotFound);
   // Dictionary has been allocated with sufficient size for all elements.
   DisallowHeapAllocation no_need_to_resize_dictionary;
   HandleScope scope(isolate());
   USE(UnseededNumberDictionary::AtNumberPut(
       dictionary_, IdToKey(ast_id), handle(target, isolate())));
 }
 
 
 } }  // namespace v8::internal