Swapped transition array and descriptor array.

src/ia32/macro-assembler-ia32.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2501 matching lines @@
   } else {
     CallRuntime(Runtime::kAbort, 2);
   }
   // will not return here
   int3();
 }
 
 
 void MacroAssembler::LoadInstanceDescriptors(Register map,
                                              Register descriptors) {
-  mov(descriptors, FieldOperand(map,
-                                Map::kInstanceDescriptorsOrBackPointerOffset));
+  Register temp = descriptors;
+  mov(temp, FieldOperand(map, Map::kTransitionsOrBackPointerOffset));
 
   Label ok, fail;
-  CheckMap(descriptors,
+  CheckMap(temp,
            isolate()->factory()->fixed_array_map(),
            &fail,
            DONT_DO_SMI_CHECK);
+  mov(descriptors, FieldOperand(temp, TransitionArray::kDescriptorsOffset));
   jmp(&ok);
   bind(&fail);
   mov(descriptors, isolate()->factory()->empty_descriptor_array());
   bind(&ok);
 }
 
 
 void MacroAssembler::LoadPowerOf2(XMMRegister dst,
                                   Register scratch,
                                   int power) {
@@ skipping 346 matching lines @@
   // Check that there are no elements.  Register ecx contains the
   // current JS object we've reached through the prototype chain.
   cmp(FieldOperand(ecx, JSObject::kElementsOffset),
       isolate()->factory()->empty_fixed_array());
   j(not_equal, call_runtime);
 
   // Check that instance descriptors are not empty so that we can
   // check for an enum cache.  Leave the map in ebx for the subsequent
   // prototype load.
   mov(ebx, FieldOperand(ecx, HeapObject::kMapOffset));
-  mov(edx, FieldOperand(ebx, Map::kInstanceDescriptorsOrBackPointerOffset));
+  mov(edx, FieldOperand(ebx, Map::kTransitionsOrBackPointerOffset));
   CheckMap(edx,
            isolate()->factory()->fixed_array_map(),
            call_runtime,
            DONT_DO_SMI_CHECK);
 
+  mov(edx, FieldOperand(edx, TransitionArray::kDescriptorsOffset));
+  cmp(edx, isolate()->factory()->empty_descriptor_array());
+  j(equal, call_runtime);
+
   // Check that there is an enum cache in the non-empty instance
   // descriptors (edx).  This is the case if the next enumeration
   // index field does not contain a smi.
   mov(edx, FieldOperand(edx, DescriptorArray::kEnumCacheOffset));
   JumpIfSmi(edx, call_runtime);
 
   // For all objects but the receiver, check that the cache is empty.
   Label check_prototype;
   cmp(ecx, eax);
   j(equal, &check_prototype, Label::kNear);
   mov(edx, FieldOperand(edx, DescriptorArray::kEnumCacheBridgeCacheOffset));
   cmp(edx, isolate()->factory()->empty_fixed_array());
   j(not_equal, call_runtime);
 
   // Load the prototype from the map and loop if non-null.
   bind(&check_prototype);
   mov(ecx, FieldOperand(ebx, Map::kPrototypeOffset));
   cmp(ecx, isolate()->factory()->null_value());
   j(not_equal, &next);
 }
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_IA32