Fix map modification in transition tree traversal.

Fix map modification in transition tree traversal.

While traversing the transition tree we build a work-list using the map
field of maps. Setting those map values with a write barrier causes
black-to-gray changes on maps which are currently not recognized as
such, hence their computed size might be off.

R=vegorov@chromium.org
BUG=v8:1672
TEST=cctest/test-decls/Present

Committed: http://code.google.com/p/v8/source/detail?r=9498

[Michael Starzinger, 2011-09-30 11:12:20]

PTAL.

[Vyacheslav Egorov (Chromium), 2011-09-30 12:43:33]

LGTM!

nice catch

http://codereview.chromium.org/8082023/diff/1/src/objects.cc
File src/objects.cc (right):

http://codereview.chromium.org/8082023/diff/1/src/objects.cc#newcode4477
src/objects.cc:4477: next->set_map(current, SKIP_WRITE_BARRIER);
let's introduce a special "unsafe" accessor that does not invoke a write
barrier.

this will allow us to easily find all places that do unsafe things with map
field.

[Michael Starzinger, 2011-09-30 13:03:04]

Added new patch set.

http://codereview.chromium.org/8082023/diff/1/src/objects.cc
File src/objects.cc (right):

http://codereview.chromium.org/8082023/diff/1/src/objects.cc#newcode4477
src/objects.cc:4477: next->set_map(current, SKIP_WRITE_BARRIER);
On 2011/09/30 12:43:33, Vyacheslav Egorov wrote:
> let's introduce a special "unsafe" accessor that does not invoke a write
> barrier.
> 
> this will allow us to easily find all places that do unsafe things with map
> field.

Done.