correctly invalidate global cells

src/code-stubs-hydrogen.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/bailout-reason.h"
 #include "src/code-stubs.h"
 #include "src/field-index.h"
 #include "src/hydrogen.h"
@@ skipping 1336 matching lines @@
     IfBuilder map_check(this);
     map_check.IfNot<HCompareObjectEqAndBranch>(expected_map, map);
     map_check.ThenDeopt(Deoptimizer::kUnknownMap);
     map_check.End();
   }
 
   HValue* weak_cell = Add<HConstant>(isolate()->factory()->NewWeakCell(
       StoreGlobalStub::property_cell_placeholder(isolate())));
   HValue* cell = Add<HLoadNamedField>(weak_cell, nullptr,
                                       HObjectAccess::ForWeakCellValue());
+  Add<HCheckHeapObject>(cell);
   HObjectAccess access(HObjectAccess::ForCellPayload(isolate()));
   HValue* cell_contents = Add<HLoadNamedField>(cell, nullptr, access);
 
   if (stub->is_constant()) {
     IfBuilder builder(this);
     builder.If<HCompareObjectEqAndBranch>(cell_contents, value);
     builder.Then();
     builder.ElseDeopt(
         Deoptimizer::kUnexpectedCellContentsInConstantGlobalStore);
     builder.End();
@@ skipping 881 matching lines @@
   // megamorphic case is handled as part of the default stub.
   DCHECK(!FLAG_vector_ics);
 
   // Probe the stub cache.
   Add<HTailCallThroughMegamorphicCache>(receiver, name);
 
   // We never continue.
   return graph()->GetConstant0();
 }
 } }  // namespace v8::internal