Fix map modification in transition tree traversal.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index aa0b6f227f25b9a74089097467f4742c26f59854..a50a96cd50a6d40b3357a77fe1ec85c2ee85379c 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -4474,7 +4474,7 @@ void Map::TraverseTransitionTree(TraverseCallback callback, void* data) {
           // of the next map and recording the index in the transition array in
           // the map field of the array.
           Map* next = Map::cast(contents->get(i));
-          next->set_map(current);
+          next->set_map(current, SKIP_WRITE_BARRIER);

[Vyacheslav Egorov (Chromium), 2011/09/30 12:43:33]

let's introduce a special "unsafe" accessor that does not invoke a write
barrier.

this will allow us to easily find all places that do unsafe things with map
field.

[Michael Starzinger, 2011/09/30 13:03:04]

Done.

           *map_or_index_field = Smi::FromInt(i + 2);
           current = next;
           map_done = false;
@@ -4499,7 +4499,7 @@ void Map::TraverseTransitionTree(TraverseCallback callback, void* data) {
       Object* perhaps_map = prototype_transitions->get(i);
       if (perhaps_map->IsMap()) {
         Map* next = Map::cast(perhaps_map);
-        next->set_map(current);
+        next->set_map(current, SKIP_WRITE_BARRIER);
         *proto_map_or_index_field =
             Smi::FromInt(i + kProtoTransitionElementsPerEntry);
         current = next;
@@ -4515,7 +4515,7 @@ void Map::TraverseTransitionTree(TraverseCallback callback, void* data) {
     // the map field, which is being used to track the traversal and put the
     // correct map (the meta_map) in place while we do the callback.
     Map* prev = current->map();
-    current->set_map(meta_map);
+    current->set_map(meta_map, SKIP_WRITE_BARRIER);
     callback(current, data);
     current = prev;
   }