Limited the size of transition arrays so they never end up in the large object space.

src/objects.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2617 matching lines @@
   bool IsConsistentWithBackPointers(Map* current_map);
 
   // Are two DescriptorArrays equal?
   bool IsEqualTo(DescriptorArray* other);
 #endif
 
   // The maximum number of descriptors we want in a descriptor array (should
   // fit in a page).
   static const int kMaxNumberOfDescriptors = 1024 + 512;
 
-  static int SizeFor(int number_of_descriptors) {
+  // Returns the fixed array length required to hold number_of_descriptors
+  // descriptors.
+  static int LengthFor(int number_of_descriptors) {
     return ToKeyIndex(number_of_descriptors);
   }
 
  private:
   // An entry in a DescriptorArray, represented as an (array, index) pair.
   class Entry {
    public:
     inline explicit Entry(DescriptorArray* descs, int index) :
         descs_(descs), index_(index) { }
 
@@ skipping 2240 matching lines @@
   // with the given holder if the name is found. The holder may be
   // NULL when this function is used from the compiler.
   void LookupDescriptor(JSObject* holder,
                         String* name,
                         LookupResult* result);
 
   void LookupTransition(JSObject* holder,
                         String* name,
                         LookupResult* result);
 
+  // The size of transition arrays are limited so they do not end up in large
+  // object space. Otherwise ClearNonLiveTransitions would leak memory while
+  // applying in-place right trimming.
+  inline bool CanHaveMoreTransitions();
+
   void SetLastAdded(int index) {
     set_bit_field3(LastAddedBits::update(bit_field3(), index));
   }
 
   int LastAdded() {
     return LastAddedBits::decode(bit_field3());
   }
 
   int NumberOfSetDescriptors() {
     ASSERT(!instance_descriptors()->IsEmpty());
@@ skipping 3998 matching lines @@
     } else {
       value &= ~(1 << bit_position);
     }
     return value;
   }
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_OBJECTS_H_