Avoid fast short-cut in Map::GeneralizeRepresentation() for literals with non-simple transitions.

src/json-parser.h

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_JSON_PARSER_H_
 #define V8_JSON_PARSER_H_
 
 #include "src/v8.h"
 
 #include "src/char-predicates-inl.h"
@@ skipping 382 matching lines @@
 
           if (value->FitsRepresentation(expected_representation)) {
             if (expected_representation.IsDouble()) {
               value = Object::NewStorageFor(isolate(), value,
                                             expected_representation);
             } else if (expected_representation.IsHeapObject() &&
                        !target->instance_descriptors()->GetFieldType(
                            descriptor)->NowContains(value)) {
               Handle<HeapType> value_type(value->OptimalType(
                       isolate(), expected_representation));
-              Map::GeneralizeFieldType(target, descriptor, value_type);
+              Map::GeneralizeFieldType(target, descriptor,
+                                       expected_representation, value_type);
             }
             DCHECK(target->instance_descriptors()->GetFieldType(
                     descriptor)->NowContains(value));
             properties.Add(value, zone());
             map = target;
             continue;
           } else {
             transitioning = false;
           }
         }
@@ skipping 397 matching lines @@
 
   DCHECK_EQ('"', c0_);
   // Advance past the last '"'.
   AdvanceSkipWhitespace();
   return result;
 }
 
 } }  // namespace v8::internal
 
 #endif  // V8_JSON_PARSER_H_