Introduce instance type for transition arrays.

src/objects-debug.cc

Index: src/objects-debug.cc
diff --git a/src/objects-debug.cc b/src/objects-debug.cc
index a87533f6f58bab81b3d6e6db506309ed7901c367..2339e2e5e2d281f090684462c35e4e1d74ff04d0 100644
--- a/src/objects-debug.cc
+++ b/src/objects-debug.cc
@@ -76,6 +76,9 @@ void HeapObject::HeapObjectVerify() {
     case BYTECODE_ARRAY_TYPE:
       BytecodeArray::cast(this)->BytecodeArrayVerify();
       break;
+    case TRANSITION_ARRAY_TYPE:
+      TransitionArray::cast(this)->TransitionArrayVerify();
+      break;
     case FREE_SPACE_TYPE:
       FreeSpace::cast(this)->FreeSpaceVerify();
       break;
@@ -407,6 +410,15 @@ void FixedDoubleArray::FixedDoubleArrayVerify() {
 }
 
 
+void TransitionArray::TransitionArrayVerify() {
+  for (int i = 0; i < length(); i++) {
+    Object* e = get(i);
+    VerifyPointer(e);
+  }

[Michael Lippautz, 2015/11/27 14:27:28]

Maybe verify that next either points to undefined or another transition array?

[ulan, 2015/11/27 14:43:45]

Done.

+  CHECK_LE(LengthFor(number_of_transitions()), length());
+}
+
+
 void JSGeneratorObject::JSGeneratorObjectVerify() {
   // In an expression like "new g()", there can be a point where a generator
   // object is allocated but its fields are all undefined, as it hasn't yet been