Move Maps' back pointers from "transitions" to "constructor" field

src/runtime/runtime-classes.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdlib.h>
 #include <limits>
 
 #include "src/v8.h"
 
 #include "src/isolate-inl.h"
@@ skipping 90 matching lines @@
       Handle<Object> args[1] = {super_class};
       THROW_NEW_ERROR_RETURN_FAILURE(
           isolate,
           NewTypeError("extends_value_not_a_function", HandleVector(args, 1)));
     }
   }
 
   Handle<Map> map =
       isolate->factory()->NewMap(JS_OBJECT_TYPE, JSObject::kHeaderSize);
   map->SetPrototype(prototype_parent);
-  map->set_constructor(*constructor);
+  map->SetConstructor(*constructor);
   Handle<JSObject> prototype = isolate->factory()->NewJSObjectFromMap(map);
 
   Handle<String> name_string = name->IsString()
                                    ? Handle<String>::cast(name)
                                    : isolate->factory()->empty_string();
   constructor->shared()->set_name(*name_string);
 
   if (!super_class->IsTheHole()) {
     Handle<Code> stub(isolate->builtins()->JSConstructStubForDerived());
     constructor->shared()->set_construct_stub(*stub);
@@ skipping 301 matching lines @@
   return *isolate->factory()->undefined_value();
 }
 
 
 RUNTIME_FUNCTION(RuntimeReference_DefaultConstructorCallSuper) {
   UNREACHABLE();
   return nullptr;
 }
 }
 }  // namespace v8::internal