Use MigrateToMap instead of set_map to update the map of a JSObject.

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index cd8999c41a3e02b0dfb418ac1ba44957c5364331..5af80a8c6f79fe98591f3f3c59049e2128c91803 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -2874,15 +2874,6 @@ class JSObject: public JSReceiver {
                               ValueType value_type,
                               TransitionFlag flag);
 
-  // Add a property to a fast-case object using a map transition to
-  // new_map.
-  static void AddFastPropertyUsingMap(Handle<JSObject> object,
-                                      Handle<Map> new_map,
-                                      Handle<Name> name,
-                                      Handle<Object> value,
-                                      int field_index,
-                                      Representation representation);
-
   // Add a property to a slow-case object.
   static void AddSlowProperty(Handle<JSObject> object,
                               Handle<Name> name,
@@ -5989,7 +5980,7 @@ class Map: public HeapObject {
 
   inline int GetInObjectPropertyOffset(int index);
 
-  int NumberOfFields();
+  int NumberOfFields(int limit = -1);
 
   bool InstancesNeedRewriting(Map* target,
                               int target_number_of_fields,