LibJS: Revoke any outstanding WeakPtr<Shape> when zombifying shapes

The forward transition cache in Shape uses WeakPtr<Shape> to learn when
a cached transition has been garbage collected.

When running in zombification mode, we have to explicitly revoke any
outstanding WeakPtrs to a Shape when it becomes a zombie. That ensures
that it gets pruned from transition caches.

Userland/Libraries/LibJS/Runtime/Shape.cpp

@@ -221,4 +221,9 @@ FLATTEN void Shape::add_property_without_transition(PropertyName const& property
     add_property_without_transition(property_name.to_string_or_symbol(), attributes);
 }
 
+void Shape::did_become_zombie()
+{
+    revoke_weak_ptrs();
+}
+
 }

Userland/Libraries/LibJS/Runtime/Shape.h

@@ -88,6 +88,7 @@ public:
 private:
     virtual const char* class_name() const override { return "Shape"; }
     virtual void visit_edges(Visitor&) override;
+    virtual void did_become_zombie() override;
 
     Shape* get_or_prune_cached_forward_transition(TransitionKey const&);
     void ensure_property_table() const;