In-place shrinking of descriptor arrays with non-live transitions.

src/profile-generator.cc

Index: src/profile-generator.cc
diff --git a/src/profile-generator.cc b/src/profile-generator.cc
index a3143bea5b8d46aac2a03bf3e696e28cc61740e6..217046f6e560303189b264cea9d70b9c5d81b70c 100644
--- a/src/profile-generator.cc
+++ b/src/profile-generator.cc
@@ -2220,7 +2220,9 @@ void V8HeapExplorer::ExtractPropertyReferences(JSObject* js_obj, int entry) {
         case INTERCEPTOR:  // only in lookup results, not in descriptors
         case MAP_TRANSITION:  // we do not care about transitions here...
         case CONSTANT_TRANSITION:
-        case NULL_DESCRIPTOR:  // ... and not about "holes"
+          break;
+        case NONEXISTENT:
+          UNREACHABLE();
           break;
       }
     }