Gcstress bug fix: Transition arrays may get smaller during gc.

src/transitions.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 68 matching lines @@
   } else {
     result = Allocate(isolate, 1);
     result->NoIncrementalWriteBarrierSet(0, *name, *target);
   }
   result->set_back_pointer_storage(map->GetBackPointer());
   return result;
 }
 
 
 Handle<TransitionArray> TransitionArray::ExtendToFullTransitionArray(
-    Handle<TransitionArray> array) {
-  ASSERT(!array->IsFullTransitionArray());
-  int nof = array->number_of_transitions();
-  Handle<TransitionArray> result = Allocate(array->GetIsolate(), nof);
+    Handle<Map> containing_map) {
+  ASSERT(!containing_map->transitions()->IsFullTransitionArray());
+  int nof = containing_map->transitions()->number_of_transitions();
 
-  if (nof == 1) {
+  // A transition array may shrink during GC.
+  Handle<TransitionArray> result = Allocate(containing_map->GetIsolate(), nof);
+  int new_nof = containing_map->transitions()->number_of_transitions();
+  if (new_nof != nof) {
+    ASSERT(new_nof == 0);
+    result->Shrink(ToKeyIndex(0));
+  } else if (nof == 1) {
     result->NoIncrementalWriteBarrierCopyFrom(
-        *array, kSimpleTransitionIndex, 0);
+        containing_map->transitions(), kSimpleTransitionIndex, 0);
   }
 
-  result->set_back_pointer_storage(array->back_pointer_storage());
+  result->set_back_pointer_storage(
+      containing_map->transitions()->back_pointer_storage());
   return result;
 }
 
 
 Handle<TransitionArray> TransitionArray::CopyInsert(Handle<Map> map,
                                                     Handle<Name> name,
                                                     Handle<Map> target,
                                                     SimpleTransitionFlag flag) {
   if (!map->HasTransitionArray()) {
     return TransitionArray::NewWith(map, name, target, flag);
@@ skipping 68 matching lines @@
     result->NoIncrementalWriteBarrierCopyFrom(
         array, insertion_index, insertion_index + 1);
   }
 
   result->set_back_pointer_storage(array->back_pointer_storage());
   return result;
 }
 
 
 } }  // namespace v8::internal