Fix putting of prototype transitions. The length is also subject to GC, just like entry.

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 11541 matching lines @@
                           break,
                           return Handle<Map>());
   }
 
   // Reload number of transitions as GC might shrink them.
   int last = map->NumberOfProtoTransitions();
   int entry = header + last * step;
 
   cache->set(entry + kProtoTransitionPrototypeOffset, *prototype);
   cache->set(entry + kProtoTransitionMapOffset, *target_map);
-  map->SetNumberOfProtoTransitions(transitions);
+  map->SetNumberOfProtoTransitions(last + 1);
 
   return map;
 }
 
 
 void Map::ZapTransitions() {
   TransitionArray* transition_array = transitions();
   // TODO(mstarzinger): Temporarily use a slower version instead of the faster
   // MemsetPointer to investigate a crasher. Switch back to MemsetPointer.
   Object** data = transition_array->data_start();
@@ skipping 4919 matching lines @@
 #define ERROR_MESSAGES_TEXTS(C, T) T,
   static const char* error_messages_[] = {
       ERROR_MESSAGES_LIST(ERROR_MESSAGES_TEXTS)
   };
 #undef ERROR_MESSAGES_TEXTS
   return error_messages_[reason];
 }
 
 
 } }  // namespace v8::internal