Ensure that all non-stable maps created by Map::AddMissingTransitions() are marked as such.

src/objects.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/objects.h"
 
 #include <cmath>
 #include <iomanip>
 #include <sstream>
 
@@ skipping 9293 matching lines @@
   // invariant since the last map is not yet connected to the transition tree
   // we create here. But it is safe because GC never trims map's descriptors
   // if there are no dead transitions from that map and this is exactly the
   // case for all the intermediate maps we create here.
   Handle<Map> map = split_map;
   for (int i = split_nof; i < nof_descriptors - 1; ++i) {
     Handle<Map> new_map = CopyDropDescriptors(map);
     InstallDescriptors(map, new_map, i, descriptors, full_layout_descriptor);
     map = new_map;
   }
+  map->NotifyLeafMapLayoutChange();
   InstallDescriptors(map, last_map, nof_descriptors - 1, descriptors,
                      full_layout_descriptor);
   return last_map;
 }
 
 
 // Since this method is used to rewrite an existing transition tree, it can
 // always insert transitions without checking.
 void Map::InstallDescriptors(Handle<Map> parent, Handle<Map> child,
                              int new_descriptor,
@@ skipping 96 matching lines @@
       break;
     default:
       UNREACHABLE();
       break;
   }
   Map* maybe_transition =
       TransitionArray::SearchSpecial(*initial_map, *transition_symbol);
   if (maybe_transition != NULL) {
     return handle(maybe_transition, isolate);
   }
+  initial_map->NotifyLeafMapLayoutChange();
 
   // Create new map taking descriptors from the |function_map| and all
   // the other details from the |initial_map|.
   Handle<Map> map =
       Map::CopyInitialMap(function_map, initial_map->instance_size(),
                           initial_map->GetInObjectProperties(),
                           initial_map->unused_property_fields());
   map->SetConstructor(initial_map->GetConstructor());
   map->set_prototype(initial_map->prototype());
 
@@ skipping 10041 matching lines @@
   if (cell->value() != *new_value) {
     cell->set_value(*new_value);
     Isolate* isolate = cell->GetIsolate();
     cell->dependent_code()->DeoptimizeDependentCodeGroup(
         isolate, DependentCode::kPropertyCellChangedGroup);
   }
 }
 
 }  // namespace internal
 }  // namespace v8