Fix TransitionArray::Sort.

R=ulan@chromium.org

Bug: v8:7303
Change-Id: Ica6db623fbb5a4c4dd3ccf1dcbd6f796bb4406fc
Reviewed-on: https://chromium-review.googlesource.com/865907Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50575}

src/transitions.cc

@@ -664,24 +664,27 @@ void TransitionArray::Sort() {
   int length = number_of_transitions();
   for (int i = 1; i < length; i++) {
     Name* key = GetKey(i);
-    Map* target = GetTarget(i);
+    Object* target = GetRawTarget(i);
     PropertyKind kind = kData;
     PropertyAttributes attributes = NONE;
     if (!TransitionsAccessor::IsSpecialTransition(key)) {
+      Map* target_map = TransitionsAccessor::GetTargetFromRaw(target);
       PropertyDetails details =
-          TransitionsAccessor::GetTargetDetails(key, target);
+          TransitionsAccessor::GetTargetDetails(key, target_map);
       kind = details.kind();
       attributes = details.attributes();
     }
     int j;
     for (j = i - 1; j >= 0; j--) {
       Name* temp_key = GetKey(j);
-      Map* temp_target = GetTarget(j);
+      Object* temp_target = GetRawTarget(j);
       PropertyKind temp_kind = kData;
       PropertyAttributes temp_attributes = NONE;
       if (!TransitionsAccessor::IsSpecialTransition(temp_key)) {
+        Map* temp_target_map =
+            TransitionsAccessor::GetTargetFromRaw(temp_target);
         PropertyDetails details =
-            TransitionsAccessor::GetTargetDetails(temp_key, temp_target);
+            TransitionsAccessor::GetTargetDetails(temp_key, temp_target_map);
         temp_kind = details.kind();
         temp_attributes = details.attributes();
       }

test/cctest/test-serialize.cc

@@ -3245,7 +3245,9 @@ UNINITIALIZED_TEST(ReinitializeHashSeedRehashable) {
           "%OptimizeObjectForAddingMultipleProperties(o, 3);"
           "o.a = 1;"
           "o.b = 2;"
-          "o.c = 3;");
+          "o.c = 3;"
+          "var p = { foo: 1 };"  // Test rehashing of transition arrays.
+          "p = JSON.parse('{\"foo\": {\"x\": 1}}');");
       i::Handle<i::Object> i_a = v8::Utils::OpenHandle(*CompileRun("a"));
       i::Handle<i::Object> i_o = v8::Utils::OpenHandle(*CompileRun("o"));
       CHECK(i_a->IsJSArray());