Move Maps' back pointers from "transitions" to "constructor" field

src/runtime/runtime-scopes.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
 #include "src/arguments.h"
 #include "src/frames-inl.h"
 #include "src/runtime/runtime-utils.h"
@@ skipping 845 matching lines @@
 static Object* ComputeReceiverForNonGlobal(Isolate* isolate, JSObject* holder) {
   DCHECK(!holder->IsGlobalObject());
   Context* top = isolate->context();
   // Get the context extension function.
   JSFunction* context_extension_function =
       top->native_context()->context_extension_function();
   // If the holder isn't a context extension object, we just return it
   // as the receiver. This allows arguments objects to be used as
   // receivers, but only if they are put in the context scope chain
   // explicitly via a with-statement.
-  Object* constructor = holder->map()->constructor();
+  Object* constructor = holder->map()->GetConstructor();
   if (constructor != context_extension_function) return holder;
   // Fall back to using the global object as the implicit receiver if
   // the property turns out to be a local variable allocated in a
   // context extension object - introduced via eval.
   return isolate->heap()->undefined_value();
 }
 
 
 static ObjectPair LoadLookupSlotHelper(Arguments args, Isolate* isolate,
                                        bool throw_error) {
@@ skipping 245 matching lines @@
   return Smi::FromInt(frame->GetArgumentsLength());
 }
 
 
 RUNTIME_FUNCTION(RuntimeReference_Arguments) {
   SealHandleScope shs(isolate);
   return __RT_impl_Runtime_GetArgumentsProperty(args, isolate);
 }
 }
 }  // namespace v8::internal