Fix IsWeakObjectInOptimizedCode predicate to also include property cells.

BUG=v8:3882
LOG=NO

Review URL: https://codereview.chromium.org/909123002

Cr-Commit-Position: refs/heads/master@{#26549}

diff --git a/src/objects-inl.h b/src/objects-inl.h
index 65e789f0328dd826f8db53a07b4672f623b84571..14392d1d6143d13691377a6856bb29e8303c42f3 100644 (file)
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -5242,7 +5242,9 @@ bool Code::IsWeakObjectInOptimizedCode(Object* object) {
     return Map::cast(object)->CanTransition() &&
            FLAG_weak_embedded_maps_in_optimized_code;
   }
-  if (object->IsCell()) object = Cell::cast(object)->value();
+  if (object->IsCell() || object->IsPropertyCell()) {
+    object = Cell::cast(object)->value();
+  }
   if (object->IsJSObject()) {
     return FLAG_weak_embedded_objects_in_optimized_code;
   }