One of the fast cases in JSObject::MigrateFastToFast() should not be taken...

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 3e83eda46f82b11c190041a7e29b0dd6d12272e9..99580563a7c50f69a3ef9ec00744f7632bcbd019 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -6285,10 +6285,9 @@ class Map: public HeapObject {
   int NumberOfFields();
 
   // TODO(ishell): candidate with JSObject::MigrateToMap().
-  bool InstancesNeedRewriting(Map* target,
-                              int target_number_of_fields,
-                              int target_inobject,
-                              int target_unused);
+  bool InstancesNeedRewriting(Map* target, int target_number_of_fields,
+                              int target_inobject, int target_unused,
+                              int* old_number_of_fields);
   // TODO(ishell): moveit!
   static Handle<Map> GeneralizeAllFieldRepresentations(Handle<Map> map);
   MUST_USE_RESULT static Handle<HeapType> GeneralizeFieldType(