Merged: [runtime] Mark old JSGlobalProxy's map as unstable when an iframe navigates away.

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 0df6545baa147f5b0d93fc262e080b24c5351278..e261d96f0a13e62cd4ebc1b3a707da2306f6dde9 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -6268,6 +6268,11 @@ class Map: public HeapObject {
       Handle<Map> split_map, Handle<DescriptorArray> descriptors,
       Handle<LayoutDescriptor> full_layout_descriptor);
 
+  // Fires when the layout of an object with a leaf map changes.
+  // This includes adding transitions to the leaf map or changing
+  // the descriptor array.
+  inline void NotifyLeafMapLayoutChange();
+
  private:
   // Returns the map that this (root) map transitions to if its elements_kind
   // is changed to |elements_kind|, or |nullptr| if no such map is cached yet.
@@ -6321,11 +6326,6 @@ class Map: public HeapObject {
       Handle<Map> map, ElementsKind elements_kind, int modify_index,
       PropertyKind kind, PropertyAttributes attributes, const char* reason);
 
-  // Fires when the layout of an object with a leaf map changes.
-  // This includes adding transitions to the leaf map or changing
-  // the descriptor array.
-  inline void NotifyLeafMapLayoutChange();
-
   void DeprecateTransitionTree();
 
   void ReplaceDescriptors(DescriptorArray* new_descriptors,