Fix crash involving zombie maps escaping from the JSON parser's underground lab

Fix crash involving zombie maps escaping from the JSON parser's underground lab

Zapping is required since transition arrays contain weak references to maps: At the end of a GC cycle, ClearNonLiveTransitions removes references to dead maps from transition arrays. If a marked transition array with weak (dead) references is replaced by another transition array before the end of the GC cycle, dead references are not removed from the replaced transition array. If the replaced transition array is kept alive by a handle, marking will crash when trying to mark the first reference to a dead map.

Committed: http://code.google.com/p/v8/source/detail?r=14063

[Jakob Kummerow, 2013-03-25 14:49:08]

PTAL.

[Toon Verwaest, 2013-03-25 15:07:44]

lgtm

[Jakob Kummerow, 2013-03-25 15:19:02]

Committed patchset #2 manually as r14063 (presubmit successful).