Cons string maps must be marked as unstable.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/247063002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20875 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/heap.cc

@@ -2586,7 +2586,11 @@ bool Heap::CreateInitialMaps() {
       { MaybeObject* maybe_obj = AllocateMap(entry.type, entry.size);
         if (!maybe_obj->ToObject(&obj)) return false;
       }
-      roots_[entry.index] = Map::cast(obj);
+      // Mark cons string maps as unstable, because their objects can change
+      // maps during GC.
+      Map* map = Map::cast(obj);
+      if (StringShape(entry.type).IsCons()) map->mark_unstable();
+      roots_[entry.index] = map;
     }
 
     ALLOCATE_VARSIZE_MAP(STRING_TYPE, undetectable_string)