Make sure to retry SetHiddenPropertiesObject if it

src/handles.cc

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 309 matching lines @@
   }
 
   // Only attempt to find the hidden properties in the local object and not
   // in the prototype chain.  Note that HasLocalProperty() can cause a GC in
   // the general case in the presence of interceptors.
   if (!obj->HasHiddenPropertiesObject()) {
     // Hidden properties object not found. Allocate a new hidden properties
     // object if requested. Otherwise return the undefined value.
     if (create_if_needed) {
       Handle<Object> hidden_obj = Factory::NewJSObject(Top::object_function());
-      return Handle<Object>(obj->SetHiddenPropertiesObject(*hidden_obj));
+      CALL_HEAP_FUNCTION(obj->SetHiddenPropertiesObject(*hidden_obj), Object);
     } else {
       return Factory::undefined_value();
     }
   }
   return Handle<Object>(obj->GetHiddenPropertiesObject());
 }
 
 
 Handle<Object> DeleteElement(Handle<JSObject> obj,
                              uint32_t index) {
@@ skipping 439 matching lines @@
   Handle<Map> new_map = Factory::CopyMapDropTransitions(old_map);
   obj->set_map(*new_map);
   new_map->set_needs_loading(true);
   // Store the lazy loading info in the constructor field.  We'll
   // reestablish the constructor from the fixed array after loading.
   new_map->set_constructor(*arr);
   ASSERT(!obj->IsLoaded());
 }
 
 } }  // namespace v8::internal