Ensure that all non-stable maps created by Map::AddMissingTransitions() are marked as such.

BUG=chromium:570131
LOG=N

Review URL: https://codereview.chromium.org/1546933002

Cr-Commit-Position: refs/heads/master@{#33029}

src/objects-debug.cc

@@ -330,6 +330,8 @@ void Map::MapVerify() {
   CHECK(instance_size() == kVariableSizeSentinel ||
          (kPointerSize <= instance_size() &&
           instance_size() < heap->Capacity()));
+  CHECK(GetBackPointer()->IsUndefined() ||
+        !Map::cast(GetBackPointer())->is_stable());
   VerifyHeapPointer(prototype());
   VerifyHeapPointer(instance_descriptors());
   SLOW_DCHECK(instance_descriptors()->IsSortedNoDuplicates());

src/objects.cc

@@ -9311,6 +9311,7 @@ Handle<Map> Map::AddMissingTransitions(
     InstallDescriptors(map, new_map, i, descriptors, full_layout_descriptor);
     map = new_map;
   }
+  map->NotifyLeafMapLayoutChange();
   InstallDescriptors(map, last_map, nof_descriptors - 1, descriptors,
                      full_layout_descriptor);
   return last_map;
@@ -9427,6 +9428,7 @@ Handle<Map> Map::AsLanguageMode(Handle<Map> initial_map,
   if (maybe_transition != NULL) {
     return handle(maybe_transition, isolate);
   }
+  initial_map->NotifyLeafMapLayoutChange();
 
   // Create new map taking descriptors from the |function_map| and all
   // the other details from the |initial_map|.

test/cctest/test-field-type-tracking.cc

@@ -621,6 +621,17 @@ static void TestGeneralizeRepresentation(
     CHECK_EQ(expected_field_type_dependency, info.dependencies()->HasAborted());
   }
 
+  {
+    // Check that all previous maps are not stable.
+    Map* tmp = *new_map;
+    while (true) {
+      Object* back = tmp->GetBackPointer();
+      if (back->IsUndefined()) break;
+      tmp = Map::cast(back);
+      CHECK(!tmp->is_stable());
+    }
+  }
+
   info.dependencies()->Rollback();  // Properly cleanup compilation info.
 
   // Update all deprecated maps and check that they are now the same.

test/cctest/test-unboxed-doubles.cc

@@ -759,12 +759,14 @@ static Handle<LayoutDescriptor> TestLayoutDescriptorAppendIfFastOrUseFull(
   int descriptors_length = descriptors->number_of_descriptors();
   std::vector<Handle<Map>> maps(descriptors_length);
   {
+    CHECK(last_map->is_stable());
     Map* map = *last_map;
     for (int i = 0; i < descriptors_length; i++) {
       maps[descriptors_length - 1 - i] = handle(map, isolate);
       Object* maybe_map = map->GetBackPointer();
       CHECK(maybe_map->IsMap());
       map = Map::cast(maybe_map);
+      CHECK(!map->is_stable());
     }
     CHECK_EQ(1, maps[0]->NumberOfOwnDescriptors());
   }