Fixed assertions when accessing the hidden properties dictionary.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index eedd9ee193201a33a34992225d64615f8f11ea82..e4f165ae44e5e64051c8ea176e5687b6869ef11b 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -3779,7 +3779,8 @@ MaybeObject* JSObject::GetHiddenPropertiesDictionary(bool create_if_absent) {
             this->FastPropertyAt(descriptors->GetFieldIndex(0));
         return StringDictionary::cast(hidden_store);
       } else {
-        ASSERT(descriptors->GetType(0) == MAP_TRANSITION);
+        ASSERT(descriptors->GetType(0) == NULL_DESCRIPTOR ||
+               descriptors->GetType(0) == MAP_TRANSITION);
       }
     }
   } else {
@@ -3826,7 +3827,8 @@ MaybeObject* JSObject::SetHiddenPropertiesDictionary(
         this->FastPropertyAtPut(descriptors->GetFieldIndex(0), dictionary);
         return this;
       } else {
-        ASSERT(descriptors->GetType(0) == MAP_TRANSITION);
+        ASSERT(descriptors->GetType(0) == NULL_DESCRIPTOR ||
+               descriptors->GetType(0) == MAP_TRANSITION);
       }
     }
   }