Bugfix: A TransitionArray can disappear during copy.

src/transitions.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 78 matching lines @@
   // Returns the number of transitions in the array.
   int number_of_transitions() {
     if (IsSimpleTransition()) return 1;
     int len = length();
     return len <= kFirstIndex ? 0 : (len - kFirstIndex) / kTransitionSize;
   }
 
   inline int number_of_entries() { return number_of_transitions(); }
 
   // Allocate a new transition array with a single entry.
-  static Handle<TransitionArray> NewWith(SimpleTransitionFlag flag,
-                                         Handle<Name> key,
+  static Handle<TransitionArray> NewWith(Handle<Map> map,
+                                         Handle<Name> name,
                                          Handle<Map> target,
-                                         Handle<Object> back_pointer);
+                                         SimpleTransitionFlag flag);
 
   MUST_USE_RESULT MaybeObject* ExtendToFullTransitionArray();
 
-  // Copy the transition array, inserting a new transition.
+  // Create a transition array, copying from the owning map if it already has
+  // one, otherwise creating a new one according to flag.
   // TODO(verwaest): This should not cause an existing transition to be
   // overwritten.
-  static Handle<TransitionArray> CopyInsert(Handle<Map> map,
-                                            Handle<Name> name,
-                                            Handle<Map> target);
+  static Handle<TransitionArray> AddTransition(Handle<Map> map,
+                                               Handle<Name> name,
+                                               Handle<Map> target,
+                                               SimpleTransitionFlag flag);
 
   // Copy a single transition from the origin array.
   inline void NoIncrementalWriteBarrierCopyFrom(TransitionArray* origin,
                                                 int origin_transition,
                                                 int target_transition);
 
   // Search a transition for a given property name.
   inline int Search(Name* name);
 
   // Allocates a TransitionArray.
@@ skipping 84 matching lines @@
                                            Name* key,
                                            Map* target);
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(TransitionArray);
 };
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_TRANSITIONS_H_