Fix PathTracer.

Fix PathTracer.

When tracing, we abuse the map for marking, thereby mutating it.
FixedTypedArrayBase::size() uses the object's map, which causes crash.

R=mstarzinger@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=21523

[Michael Starzinger, 2014-05-27 12:19:55]

LGTM with suggestion.

https://codereview.chromium.org/300753002/diff/20001/src/objects.h
File src/objects.h (right):

https://codereview.chromium.org/300753002/diff/20001/src/objects.h#newcode5080
src/objects.h:5080: inline int SizeFromMap(Map* map);
nit: Instead of overloading the SizeFromMap() name, can we call this
TypedArraySize() instead? Also it might make sense to consider passing the
InstanceType instead of the map.

[Yang, 2014-05-27 13:04:11]

On 2014/05/27 12:19:55, Michael Starzinger wrote:
> LGTM with suggestion.
> 
> https://codereview.chromium.org/300753002/diff/20001/src/objects.h
> File src/objects.h (right):
> 
> https://codereview.chromium.org/300753002/diff/20001/src/objects.h#newcode5080
> src/objects.h:5080: inline int SizeFromMap(Map* map);
> nit: Instead of overloading the SizeFromMap() name, can we call this
> TypedArraySize() instead? Also it might make sense to consider passing the
> InstanceType instead of the map.

Done.

[Yang, 2014-05-27 13:05:18]

Committed patchset #3 manually as r21523 (presubmit successful).