This matches the behavior of JSObject::JSObjectVerify() and seems to be the current contract for --verify-heap. BUG=chromium:572590 LOG=n Review URL: https://codereview.chromium.org/1553463002 Cr-Commit-Position: refs/heads/master@{#33056}