Fix for an assertion failure in Map::FindTransitionToField(...). Appeared after r25136.

BUG=chromium:430846
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/704183002

Cr-Commit-Position: refs/heads/master@{#25185}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25185 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/objects-inl.h

@@ -1886,8 +1886,9 @@ Handle<Map> Map::FindTransitionToField(Handle<Map> map, Handle<Name> key) {
   TransitionArray* transitions = map->transitions();
   int transition = transitions->Search(FIELD, *key, NONE);
   if (transition == TransitionArray::kNotFound) return Handle<Map>::null();
-  DCHECK_EQ(FIELD, transitions->GetTargetDetails(transition).type());
-  DCHECK_EQ(NONE, transitions->GetTargetDetails(transition).attributes());
+  PropertyDetails details = transitions->GetTargetDetails(transition);
+  if (details.type() != FIELD) return Handle<Map>::null();
+  DCHECK_EQ(NONE, details.attributes());
   return Handle<Map>(transitions->GetTarget(transition));
 }
 

test/mjsunit/regress/regress-crbug-430846.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() { return 1; };
+var o1 = {};
+o1.foo = foo;
+
+var json = '{"foo": {"x": 1}}';
+var o2 = JSON.parse(json);
+var o3 = JSON.parse(json);
+assertTrue(%HaveSameMap(o2, o3));