Handle CALLBACKS with map transitions when doing GC in the map tree.

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 68711769444ccd9bf9a095283815a572f5919cf3..9ec0ea64fe7c5af9ae07680003af443769ee79ce 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -4670,7 +4670,7 @@ class Map: public HeapObject {
   // This is undone in MarkCompactCollector::ClearNonLiveTransitions().
   void CreateBackPointers();
 
-  void CreateOneBackPointer(Map* transition_target);
+  void CreateOneBackPointer(Object* transition_target);
 
   // Set all map transitions from this map to dead maps to null.
   // Also, restore the original prototype on the targets of these
@@ -4678,6 +4678,13 @@ class Map: public HeapObject {
   // following back pointers.
   void ClearNonLiveTransitions(Heap* heap, Object* real_prototype);
 
+  // Restore a possible back pointer in the prototype field of object.
+  // Return true in that case and false otherwise. Set *keep_entry to
+  // true when a live map transition has been found.
+  bool RestoreOneBackPointer(Object* object,
+                             Object* real_prototype,
+                             bool* keep_entry);
+
   // Computes a hash value for this map, to be used in HashTables and such.
   int Hash();