It seems that the GC bug in V8 is something the V8 developers have been aware of for some time, but have not been able to track down and debug because they don't have a deterministic test setup where they can reproduce the bug. I sent them a message on this wiki:

http://code.google.com/p/chromium/issues/detail?id=59688

and they responded with:

Comment 15 by project member vegorov@chromium.org, Today (3 hours ago)

These are amazing news, Marc! Yes we would very appreciate a reproduction!

CreateBackPointers traverses map's transition tree and creates back pointers (from transition target to it's source). This is a preparation step for a full garbage collection. GC will use these pointers to properly handle maps which are no longer used by any live object but still should be retained because they are part of the path between two used maps.

So I suggest that we create a tar ball we can send them with the relevant sources, and instructions on how to recompile d8, and how to reproduce the bug.

Who can take charge of this?

Marc