Fix map equivalence check.

Given a map, its HasNonInstancePrototype bit in bit_field can differ
from the same bit in that map's root map. If that is the case just
return false from the equivalence check. (Currently, we just assert
that bit_field is the same for a map and its root map.)

Bug: chromium:930486
Change-Id: Ic0eb83f80725fb1224e0f97927127e1cb8ad92e6
Reviewed-on: https://chromium-review.googlesource.com/c/1462004Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59508}

src/objects/map.cc

@@ -2432,9 +2432,9 @@ bool CheckEquivalent(const Map first, const Map second) {
 bool Map::EquivalentToForTransition(const Map other) const {
   CHECK_EQ(GetConstructor(), other->GetConstructor());
   CHECK_EQ(instance_type(), other->instance_type());
-  CHECK_EQ(bit_field(), other->bit_field());
   CHECK_EQ(has_hidden_prototype(), other->has_hidden_prototype());
 
+  if (bit_field() != other->bit_field()) return false;
   if (new_target_is_base() != other->new_target_is_base()) return false;
   if (prototype() != other->prototype()) return false;
   if (instance_type() == JS_FUNCTION_TYPE) {

test/mjsunit/regress/regress-930486.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var __v_49026 = function () {};
+
+__v_49026.prototype = undefined;
+__v_49026.x = 23;
+__v_49026.prototype = new ArrayBuffer();
+__v_49026.x = 2147483649;