Always mark the entire valid prefix of the descriptor array.

Always mark the entire valid prefix of the descriptor array.

Previously we would only mark the slot that was added specifically for
this map, if there was a backpointer and the descriptor array was shared
via the backpointer. However, ConvertTransitionToMapTransition may break
this link after we marked the transitioned map, before we marked the
transitioning map. So the descriptor slots of the parent map won't get
recorded, and we potentially point to an old address of an already
relocated function.

BUG=chromium:196331
Committed: https://code.google.com/p/v8/source/detail?r=14027

[Toon Verwaest, 2013-03-21 10:46:43]

PTAL

[Michael Starzinger, 2013-03-21 12:15:36]

LGTM with a nit.

https://chromiumcodereview.appspot.com/12836005/diff/1/src/objects-visiting-i...
File src/objects-visiting-inl.h (right):

https://chromiumcodereview.appspot.com/12836005/diff/1/src/objects-visiting-i...
src/objects-visiting-inl.h:400: // descriptors that appeared for this map are
marked. The first time a
s/appeared for/belong to/

[Toon Verwaest, 2013-03-21 12:19:09]

Addressed comment

[Toon Verwaest, 2013-03-21 12:19:30]

Committed patchset #2 manually as r14027 (presubmit successful).