@@ -3027,7 +3027,7 @@ void MarkCompactCollector::ClearJSWeakRefs() {
|
3027 | 3027 | }; |
3028 | 3028 | HeapObject target = HeapObject::cast(weak_cell.target()); |
3029 | 3029 | if (!non_atomic_marking_state()->IsBlackOrGrey(target)) { |
3030 | | -DCHECK(!target.IsUndefined()); |
| 3030 | +DCHECK(target.CanBeHeldWeakly()); |
3031 | 3031 | // The value of the WeakCell is dead. |
3032 | 3032 | JSFinalizationRegistry finalization_registry = |
3033 | 3033 | JSFinalizationRegistry::cast(weak_cell.finalization_registry()); |
@@ -3049,6 +3049,7 @@ void MarkCompactCollector::ClearJSWeakRefs() {
|
3049 | 3049 | |
3050 | 3050 | HeapObject unregister_token = weak_cell.unregister_token(); |
3051 | 3051 | if (!non_atomic_marking_state()->IsBlackOrGrey(unregister_token)) { |
| 3052 | +DCHECK(unregister_token.CanBeHeldWeakly()); |
3052 | 3053 | // The unregister token is dead. Remove any corresponding entries in the |
3053 | 3054 | // key map. Multiple WeakCell with the same token will have all their |
3054 | 3055 | // unregister_token field set to undefined when processing the first |
@@ -3057,7 +3058,7 @@ void MarkCompactCollector::ClearJSWeakRefs() {
|
3057 | 3058 | JSFinalizationRegistry finalization_registry = |
3058 | 3059 | JSFinalizationRegistry::cast(weak_cell.finalization_registry()); |
3059 | 3060 | finalization_registry.RemoveUnregisterToken( |
3060 | | -JSReceiver::cast(unregister_token), isolate(), |
| 3061 | + unregister_token, isolate(), |
3061 | 3062 | JSFinalizationRegistry::kKeepMatchedCellsInRegistry, |
3062 | 3063 | gc_notify_updated_slot); |
3063 | 3064 | } else { |
|