Merged: [runtime] Mark old JSGlobalProxy's map as unstable when an iframe navigates away.

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 4dddd0bc56629befbd1c91542fc1787ce84b588c..3f07469e9d64347333095589068f2799b8e80ad9 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -6441,6 +6441,11 @@ class Map: public HeapObject {
       Handle<Map> split_map, Handle<DescriptorArray> descriptors,
       Handle<LayoutDescriptor> full_layout_descriptor);
 
+  // Fires when the layout of an object with a leaf map changes.
+  // This includes adding transitions to the leaf map or changing
+  // the descriptor array.
+  inline void NotifyLeafMapLayoutChange();
+
  private:
   // Returns the map that this (root) map transitions to if its elements_kind
   // is changed to |elements_kind|, or |nullptr| if no such map is cached yet.
@@ -6494,11 +6499,6 @@ class Map: public HeapObject {
       Handle<Map> map, ElementsKind elements_kind, int modify_index,
       PropertyKind kind, PropertyAttributes attributes, const char* reason);
 
-  // Fires when the layout of an object with a leaf map changes.
-  // This includes adding transitions to the leaf map or changing
-  // the descriptor array.
-  inline void NotifyLeafMapLayoutChange();
-
   void DeprecateTransitionTree();
 
   void ReplaceDescriptors(DescriptorArray* new_descriptors,