Move Maps' back pointers from "transitions" to "constructor" field

test/mjsunit/function-prototype.js

 // Copyright 2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 16 matching lines @@
 
 // Test that we can set function prototypes to non-object values.  The
 // prototype used for instances in that case should be the initial
 // object prototype.  ECMA-262 13.2.2.
 function TestNonObjectPrototype(value) {
   function F() {};
   F.prototype = value;
   var f = new F();
   assertEquals(value, F.prototype);
   assertEquals(Object.prototype, f.__proto__);
+  // Test that map transitions don't break anything.
+  F.property = "value";
+  assertEquals(value, F.prototype);
 }
 
 var values = [123, "asdf", true];
 
 values.forEach(TestNonObjectPrototype);
 
 
 // Test moving between non-object and object values.
 function F() {};
 var f = new F();
@@ skipping 61 matching lines @@
 var desc = Object.getOwnPropertyDescriptor(f, "prototype");
 assertFalse(desc.configurable);
 assertFalse(desc.enumerable);
 assertTrue(desc.writable);
 
 f = function () { return 1; }
 var desc = Object.getOwnPropertyDescriptor(f, "prototype");
 assertFalse(desc.configurable);
 assertFalse(desc.enumerable);
 assertTrue(desc.writable);