Always mark the entire valid prefix of the descriptor array.

src/objects-visiting-inl.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 379 matching lines @@
   // fields of this map are visited.
   TransitionArray* transitions = map->unchecked_transition_array();
   if (transitions->IsTransitionArray()) {
     MarkTransitionArray(heap, transitions);
   } else {
     // Already marked by marking map->GetBackPointer() above.
     ASSERT(transitions->IsMap() || transitions->IsUndefined());
   }
 
   // Since descriptor arrays are potentially shared, ensure that only the
   // descriptors that appeared for this map are marked. The first time a

[Michael Starzinger, 2013/03/21 12:15:36]

s/appeared for/belong to/

   // non-empty descriptor array is marked, its header is also visited. The slot
   // holding the descriptor array will be implicitly recorded when the pointer
   // fields of this map are visited.
   DescriptorArray* descriptors = map->instance_descriptors();
   if (StaticVisitor::MarkObjectWithoutPush(heap, descriptors) &&
       descriptors->length() > 0) {
     StaticVisitor::VisitPointers(heap,
         descriptors->GetFirstElementAddress(),
         descriptors->GetDescriptorEndSlot(0));
   }
   int start = 0;
   int end = map->NumberOfOwnDescriptors();
-  Object* back_pointer = map->GetBackPointer();
-  if (!back_pointer->IsUndefined()) {
-    Map* parent_map = Map::cast(back_pointer);
-    if (descriptors == parent_map->instance_descriptors()) {
-      start = parent_map->NumberOfOwnDescriptors();
-    }
-  }
   if (start < end) {
     StaticVisitor::VisitPointers(heap,
         descriptors->GetDescriptorStartSlot(start),
         descriptors->GetDescriptorEndSlot(end));
   }
 
   // Mark prototype dependent codes array but do not push it onto marking
   // stack, this will make references from it weak. We will clean dead
   // codes when we iterate over maps in ClearNonLiveTransitions.
   Object** slot = HeapObject::RawField(map, Map::kDependentCodeOffset);
@@ skipping 286 matching lines @@
   RelocIterator it(this, mode_mask);
   for (; !it.done(); it.next()) {
     it.rinfo()->template Visit<StaticVisitor>(heap);
   }
 }
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_OBJECTS_VISITING_INL_H_