Fix bug in Map::TraverseTransitionTree.

If map has an empty DescriptorArray we have to set map_or_index_field to NULL otherwise we will
reset iteration state for a previously visited map in the transition tree which has a non-empty
DescriptorArray. This might result in visiting the same map several times.

R=whesse@chromium.org
BUG=v8:1526

Review URL: http://codereview.chromium.org/7329043

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8596 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/objects.cc

@@ -4122,6 +4122,8 @@ void Map::TraverseTransitionTree(TraverseCallback callback, void* data) {
         }
       }
       if (!map_done) continue;
+    } else {
+      map_or_index_field = NULL;
     }
     // That was the regular transitions, now for the prototype transitions.
     FixedArray* prototype_transitions =