Fix memory leak caused by field type in descriptor array.

test/cctest/test-migrations.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdlib.h>
 #include <utility>
 
 #include "src/v8.h"
 
 #include "src/code-stubs.h"
@@ skipping 215 matching lines @@
     }
   }
 
 
   bool Check(DescriptorArray* descriptors, int descriptor) const {
     PropertyType type = types_[descriptor];
     if (!EqualDetails(descriptors, descriptor, type, attributes_[descriptor],
                       representations_[descriptor])) {
       return false;
     }
+    Object* value = descriptors->GetValue(descriptor);
     Object* expected_value = *values_[descriptor];
-    Object* value = descriptors->GetValue(descriptor);
     switch (type) {
       case DATA:
-      case ACCESSOR:
-        return HeapType::cast(expected_value)->Equals(HeapType::cast(value));
+      case ACCESSOR: {
+        HeapType* type = descriptors->GetFieldType(descriptor);
+        return HeapType::cast(expected_value)->Equals(type);
+      }
 
       case DATA_CONSTANT:
         return value == expected_value;
 
       case ACCESSOR_CONSTANT: {
         if (value == expected_value) return true;
         if (!value->IsAccessorPair()) return false;
         AccessorPair* pair = AccessorPair::cast(value);
         return pair->Equals(expected_value, *setter_values_[descriptor]);
       }
@@ skipping 1823 matching lines @@
   Handle<AccessorPair> pair = CreateAccessorPair(true, true);
   TransitionToAccessorConstantOperator transition_op(pair);
 
   SameMapChecker checker;
   TestTransitionTo(transition_op, transition_op, checker);
 }
 
 
 // TODO(ishell): add this test once IS_ACCESSOR_FIELD_SUPPORTED is supported.
 // TEST(TransitionAccessorConstantToAnotherAccessorConstant)