Fix missing write-barrier for prototype transitions.

src/mark-compact.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2286 matching lines @@
     int new_number_of_transitions = 0;
     const int header = Map::kProtoTransitionHeaderSize;
     const int proto_offset =
         header + Map::kProtoTransitionPrototypeOffset;
     const int map_offset = header + Map::kProtoTransitionMapOffset;
     const int step = Map::kProtoTransitionElementsPerEntry;
     for (int i = 0; i < number_of_transitions; i++) {
       Object* prototype = prototype_transitions->get(proto_offset + i * step);
       Object* cached_map = prototype_transitions->get(map_offset + i * step);
       if (IsMarked(prototype) && IsMarked(cached_map)) {
+        int proto_index = proto_offset + new_number_of_transitions * step;
+        int map_index = map_offset + new_number_of_transitions * step;
         if (new_number_of_transitions != i) {
           prototype_transitions->set_unchecked(
               heap_,
-              proto_offset + new_number_of_transitions * step,
+              proto_index,
               prototype,
               UPDATE_WRITE_BARRIER);
           prototype_transitions->set_unchecked(
               heap_,
-              map_offset + new_number_of_transitions * step,
+              map_index,
               cached_map,
               SKIP_WRITE_BARRIER);
         }
+        Object** slot =
+            HeapObject::RawField(prototype_transitions,
+                                 FixedArray::OffsetOfElementAt(proto_index));
+        RecordSlot(slot, slot, prototype);
         new_number_of_transitions++;
       }
     }
 
     if (new_number_of_transitions != number_of_transitions) {
       map->SetNumberOfProtoTransitions(new_number_of_transitions);
     }
 
     // Fill slots that became free with undefined value.
     for (int i = new_number_of_transitions * step;
@@ skipping 1578 matching lines @@
   while (buffer != NULL) {
     SlotsBuffer* next_buffer = buffer->next();
     DeallocateBuffer(buffer);
     buffer = next_buffer;
   }
   *buffer_address = NULL;
 }
 
 
 } }  // namespace v8::internal