[runtime] Deprecate old prototype maps

Bug: chromium:757199
Change-Id: I5936fab1784ebf8de6eddd3b2bec0e2cf1b73f82
Reviewed-on: https://chromium-review.googlesource.com/632317Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47581}

src/feedback-vector.cc

@@ -728,6 +728,7 @@ int FeedbackNexus::ExtractMaps(MapHandles* maps) const {
       WeakCell* cell = WeakCell::cast(array->get(i));
       if (!cell->cleared()) {
         Map* map = Map::cast(cell->value());
+        if (map->is_deprecated()) continue;
         maps->push_back(handle(map, isolate));
         found++;
       }
@@ -737,6 +738,7 @@ int FeedbackNexus::ExtractMaps(MapHandles* maps) const {
     WeakCell* cell = WeakCell::cast(feedback);
     if (!cell->cleared()) {
       Map* map = Map::cast(cell->value());
+      if (map->is_deprecated()) return 0;
       maps->push_back(handle(map, isolate));
       return 1;
     }

src/objects.cc

@@ -9183,6 +9183,7 @@ Handle<Map> Map::CopyReplaceDescriptors(
     }
   } else {
     result->InitializeDescriptors(*descriptors, *layout_descriptor);
+    map->deprecate();
   }
 #if V8_TRACE_MAPS
   if (FLAG_trace_maps &&

test/mjsunit/regress/regress-crbug-757199.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var obj1 = {};
+var obj2 = {};
+
+function h() {}
+
+h.prototype = obj2;
+
+function g(v) {
+  v.constructor;
+}
+function f() {
+  g(obj1);
+}
+
+obj1.x = 0;
+f();
+
+obj1.__defineGetter__("x", function() {});
+
+g(obj2);
+
+obj2.y = 0;
+
+%OptimizeFunctionOnNextCall(f);
+f();