Always mark entire prototype descriptor arrays.

src/heap/objects-visiting-inl.h

Index: src/heap/objects-visiting-inl.h
diff --git a/src/heap/objects-visiting-inl.h b/src/heap/objects-visiting-inl.h
index ed6db7b9b4b5f7924f716ab44136f7f0b79881c6..d6a9d2ba308c9420493a8a4d2d4c9bc78f41e777 100644
--- a/src/heap/objects-visiting-inl.h
+++ b/src/heap/objects-visiting-inl.h
@@ -542,23 +542,29 @@ void StaticMarkingVisitor<StaticVisitor>::MarkMapContents(Heap* heap,
     MarkTransitionArray(heap, TransitionArray::cast(raw_transitions));
   }
 
-  // Since descriptor arrays are potentially shared, ensure that only the
-  // descriptors that belong to this map are marked. The first time a
-  // non-empty descriptor array is marked, its header is also visited. The slot
-  // holding the descriptor array will be implicitly recorded when the pointer
-  // fields of this map are visited.
   DescriptorArray* descriptors = map->instance_descriptors();
-  if (StaticVisitor::MarkObjectWithoutPush(heap, descriptors) &&
-      descriptors->length() > 0) {
-    StaticVisitor::VisitPointers(heap, descriptors->GetFirstElementAddress(),
-                                 descriptors->GetDescriptorEndSlot(0));
-  }
-  int start = 0;
-  int end = map->NumberOfOwnDescriptors();
-  if (start < end) {
-    StaticVisitor::VisitPointers(heap,
-                                 descriptors->GetDescriptorStartSlot(start),
-                                 descriptors->GetDescriptorEndSlot(end));
+  if (map->is_prototype_map()) {
+    // Prototype maps don't keep track of transitions, so just mark the entire
+    // descriptor array.
+    StaticVisitor::MarkObject(heap, descriptors);

[ulan, 2015/07/06 09:47:04]

No need to mark the array explicitly here: line 573 will take care of it and
also record the slot correctly.

+  } else {
+    // Since descriptor arrays are potentially shared, ensure that only the
+    // descriptors that belong to this map are marked. The first time a
+    // non-empty descriptor array is marked, its header is also visited. The
+    // slot holding the descriptor array will be implicitly recorded when the
+    // pointer fields of this map are visited.
+    if (StaticVisitor::MarkObjectWithoutPush(heap, descriptors) &&
+        descriptors->length() > 0) {
+      StaticVisitor::VisitPointers(heap, descriptors->GetFirstElementAddress(),
+                                   descriptors->GetDescriptorEndSlot(0));
+    }
+    int start = 0;
+    int end = map->NumberOfOwnDescriptors();
+    if (start < end) {
+      StaticVisitor::VisitPointers(heap,
+                                   descriptors->GetDescriptorStartSlot(start),
+                                   descriptors->GetDescriptorEndSlot(end));
+    }
   }
 
   // Mark the pointer fields of the Map. Since the transitions array has