Index: src/objects.cc |
diff --git a/src/objects.cc b/src/objects.cc |
index cbef145d971a84c9c601234b0241337b3dae2f2e..c7d4e7d640339a30ba4be4ac3f34ef0bcc5cb10c 100644 |
--- a/src/objects.cc |
+++ b/src/objects.cc |
@@ -1784,8 +1784,11 @@ MaybeObject* JSObject::ConvertTransitionToMapTransition( |
old_target->SetBackPointer(GetHeap()->undefined_value()); |
MaybeObject* maybe_failure = old_target->SetDescriptors(old_descriptors); |
- if (maybe_failure->IsFailure()) return maybe_failure; |
+ // Reset the backpointer before returning failure, otherwise the map ends up |
+ // with an undefined backpointer and no descriptors, losing its own |
+ // descriptors. Setting the backpointer always succeeds. |
old_target->SetBackPointer(old_map); |
+ if (maybe_failure->IsFailure()) return maybe_failure; |
old_map->set_owns_descriptors(true); |
} |