Add missing checks for failure after AddElementsTransition.

Review URL: https://chromiumcodereview.appspot.com/9416058

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10742 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/objects-inl.h

@@ -3938,13 +3938,17 @@ MaybeObject* JSFunction::set_initial_map_and_cache_transitions(
     Map* new_double_map = NULL;
     if (!maybe_map->To<Map>(&new_double_map)) return maybe_map;
     new_double_map->set_elements_kind(FAST_DOUBLE_ELEMENTS);
-    initial_map->AddElementsTransition(FAST_DOUBLE_ELEMENTS, new_double_map);
+    maybe_map = initial_map->AddElementsTransition(FAST_DOUBLE_ELEMENTS,
+                                                   new_double_map);
+    if (maybe_map->IsFailure()) return maybe_map;
 
     maybe_map = new_double_map->CopyDropTransitions();
     Map* new_object_map = NULL;
     if (!maybe_map->To<Map>(&new_object_map)) return maybe_map;
     new_object_map->set_elements_kind(FAST_ELEMENTS);
-    new_double_map->AddElementsTransition(FAST_ELEMENTS, new_object_map);
+    maybe_map = new_double_map->AddElementsTransition(FAST_ELEMENTS,
+                                                      new_object_map);
+    if (maybe_map->IsFailure()) return maybe_map;
 
     global_context->set_smi_js_array_map(initial_map);
     global_context->set_double_js_array_map(new_double_map);

src/objects.h

@@ -4736,8 +4736,8 @@ class Map: public HeapObject {
 
   // Adds an entry to this map's descriptor array for a transition to
   // |transitioned_map| when its elements_kind is changed to |elements_kind|.
-  MaybeObject* AddElementsTransition(ElementsKind elements_kind,
-                                     Map* transitioned_map);
+  MUST_USE_RESULT MaybeObject* AddElementsTransition(
+      ElementsKind elements_kind, Map* transitioned_map);
 
   // Returns the transitioned map for this map with the most generic
   // elements_kind that's found in |candidates|, or null handle if no match is