Always record all the slots of descriptor arrays to avoid crashes due to

src/objects-visiting-inl.h

Index: src/objects-visiting-inl.h
diff --git a/src/objects-visiting-inl.h b/src/objects-visiting-inl.h
index 5201a7b3180ecd2a8ad593f2b68aebc53e5bfa7a..c725f43c20874f71d9c60e1d6255b22eba599780 100644
--- a/src/objects-visiting-inl.h
+++ b/src/objects-visiting-inl.h
@@ -628,8 +628,23 @@ void StaticMarkingVisitor<StaticVisitor>::MarkMapContents(
   // holding the descriptor array will be implicitly recorded when the pointer
   // fields of this map are visited.
   DescriptorArray* descriptors = map->instance_descriptors();
+  MarkCompactCollector* collector = heap->mark_compact_collector();
+
   if (StaticVisitor::MarkObjectWithoutPush(heap, descriptors) &&
       descriptors->length() > 0) {
+    // Record all keys and values in the descriptor array to ensure that they
+    // are updated if they are on evacuation candidates and are alive, but the
+    // descriptor array is not yet installed in the map that's adding the
+    // descriptors.
+    for (int i = 0; i < descriptors->number_of_descriptors(); i++) {
+      Object** key_slot = descriptors->GetKeySlot(i);
+      ASSERT((*key_slot)->IsHeapObject());
+      collector->RecordSlot(key_slot, key_slot, *key_slot);
+      Object** value_slot = descriptors->GetValueSlot(i);
+      if ((*value_slot)->IsHeapObject()) {
+        collector->RecordSlot(value_slot, value_slot, *value_slot);
+      }
+    }
     StaticVisitor::VisitPointers(heap,
         descriptors->GetFirstElementAddress(),
         descriptors->GetDescriptorEndSlot(0));
@@ -637,9 +652,13 @@ void StaticMarkingVisitor<StaticVisitor>::MarkMapContents(
   int start = 0;
   int end = map->NumberOfOwnDescriptors();
   if (start < end) {
-    StaticVisitor::VisitPointers(heap,
-        descriptors->GetDescriptorStartSlot(start),
-        descriptors->GetDescriptorEndSlot(end));
+    for (Object** p = descriptors->GetDescriptorStartSlot(start);
+         p < descriptors->GetDescriptorEndSlot(end);
+         p++) {
+      if ((*p)->IsHeapObject()) {
+        StaticVisitor::MarkObject(heap, HeapObject::cast(*p));
+      }
+    }
   }
 
   // Mark prototype dependent codes array but do not push it onto marking
@@ -647,7 +666,7 @@ void StaticMarkingVisitor<StaticVisitor>::MarkMapContents(
   // codes when we iterate over maps in ClearNonLiveTransitions.
   Object** slot = HeapObject::RawField(map, Map::kDependentCodeOffset);
   HeapObject* obj = HeapObject::cast(*slot);
-  heap->mark_compact_collector()->RecordSlot(slot, slot, obj);
+  collector->RecordSlot(slot, slot, obj);
   StaticVisitor::MarkObjectWithoutPush(heap, obj);
 
   // Mark the pointer fields of the Map. Since the transitions array has