Fix putting of prototype transitions. The length is also subject to GC, just like entry.

src/mark-compact.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2635 matching lines @@
 
   int new_number_of_transitions = 0;
   const int header = Map::kProtoTransitionHeaderSize;
   const int proto_offset = header + Map::kProtoTransitionPrototypeOffset;
   const int map_offset = header + Map::kProtoTransitionMapOffset;
   const int step = Map::kProtoTransitionElementsPerEntry;
   for (int i = 0; i < number_of_transitions; i++) {
     Object* prototype = prototype_transitions->get(proto_offset + i * step);
     Object* cached_map = prototype_transitions->get(map_offset + i * step);
     if (IsMarked(prototype) && IsMarked(cached_map)) {
+      ASSERT(!prototype->IsUndefined());
       int proto_index = proto_offset + new_number_of_transitions * step;
       int map_index = map_offset + new_number_of_transitions * step;
       if (new_number_of_transitions != i) {
         prototype_transitions->set(
             proto_index,
             prototype,
             UPDATE_WRITE_BARRIER);
         prototype_transitions->set(
             map_index,
             cached_map,
@@ skipping 1810 matching lines @@
   while (buffer != NULL) {
     SlotsBuffer* next_buffer = buffer->next();
     DeallocateBuffer(buffer);
     buffer = next_buffer;
   }
   *buffer_address = NULL;
 }
 
 
 } }  // namespace v8::internal