Previously we would only mark the slot that was added specifically for
this map, if there was a backpointer and the descriptor array was shared
via the backpointer. However, ConvertTransitionToMapTransition may break
this link after we marked the transitioned map, before we marked the
transitioning map. So the descriptor slots of the parent map won't get
recorded, and we potentially point to an old address of an already
relocated function.

BUG=chromium:196331

Review URL: https://chromiumcodereview.appspot.com/12836005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14027 ce2b1a6d-e550-0410-aec6-3dcde31c8c00