Bugfix: A TransitionArray can disappear during copy.

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2483 matching lines @@
   // thread can not get confused with the filler creation. No synchronization
   // needed.
   object->set_map(*new_map);
 }
 
 
 Handle<TransitionArray> Map::AddTransition(Handle<Map> map,
                                            Handle<Name> key,
                                            Handle<Map> target,
                                            SimpleTransitionFlag flag) {
-  if (map->HasTransitionArray()) {
-    return TransitionArray::CopyInsert(map, key, target);
-  }
-  return TransitionArray::NewWith(
-      flag, key, target, handle(map->GetBackPointer(), map->GetIsolate()));
+  return TransitionArray::AddTransition(map, key, target, flag);

[Toon Verwaest, 2014/04/10 11:49:28]

I presume there's no point anymore to having this wrapper on Map?

[mvstanton, 2014/04/10 13:10:45]

Yep, bye-bye silly wabbit.

 }
 
 
 void JSObject::GeneralizeFieldRepresentation(Handle<JSObject> object,
                                              int modify_index,
                                              Representation new_representation,
                                              StoreMode store_mode) {
   Handle<Map> new_map = Map::GeneralizeRepresentation(
       handle(object->map()), modify_index, new_representation, store_mode);
   if (object->map() == *new_map) return;
@@ skipping 14112 matching lines @@
 #define ERROR_MESSAGES_TEXTS(C, T) T,
   static const char* error_messages_[] = {
       ERROR_MESSAGES_LIST(ERROR_MESSAGES_TEXTS)
   };
 #undef ERROR_MESSAGES_TEXTS
   return error_messages_[reason];
 }
 
 
 } }  // namespace v8::internal