[runtime] Ensure that all elements kind transitions are chained to the root map.

src/ic/ic-compiler.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/ic/ic-compiler.h"
 
 #include "src/ic/handler-compiler.h"
 #include "src/ic/ic-inl.h"
 #include "src/profiler/cpu-profiler.h"
 
@@ skipping 65 matching lines @@
       receiver_maps, transitioned_maps, handlers, store_mode);
 }
 
 
 void PropertyICCompiler::CompileKeyedStorePolymorphicHandlers(
     MapHandleList* receiver_maps, MapHandleList* transitioned_maps,
     CodeHandleList* handlers, KeyedAccessStoreMode store_mode) {
   for (int i = 0; i < receiver_maps->length(); ++i) {
     Handle<Map> receiver_map(receiver_maps->at(i));
     Handle<Code> cached_stub;
-    Handle<Map> transitioned_map =
-        Map::FindTransitionedMap(receiver_map, receiver_maps);
+    Handle<Map> transitioned_map;
+    {
+      Map* tmap = receiver_map->FindElementsKindTransitionedMap(receiver_maps);
+      if (tmap != nullptr) transitioned_map = handle(tmap);
+    }
 
     // TODO(mvstanton): The code below is doing pessimistic elements
     // transitions. I would like to stop doing that and rely on Allocation Site
     // Tracking to do a better job of ensuring the data types are what they need
     // to be. Not all the elements are in place yet, pessimistic elements
     // transitions are still important for performance.
     bool is_js_array = receiver_map->instance_type() == JS_ARRAY_TYPE;
     ElementsKind elements_kind = receiver_map->elements_kind();
     if (!transitioned_map.is_null()) {
       cached_stub =
@@ skipping 44 matching lines @@
     TRACE_HANDLER_STATS(isolate(), KeyedStoreIC_StoreElementStub);
     stub = StoreElementStub(isolate(), elements_kind, store_mode).GetCode();
   }
   return stub;
 }
 
 
 #undef __
 }  // namespace internal
 }  // namespace v8