Remember to update the write barrier when storing into...

src/x64/full-codegen-x64.cc

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 77 matching lines @@
 
       // Copy any necessary parameters into the context.
       int num_parameters = fun->scope()->num_parameters();
       for (int i = 0; i < num_parameters; i++) {
         Slot* slot = fun->scope()->parameter(i)->slot();
         if (slot != NULL && slot->type() == Slot::CONTEXT) {
           int parameter_offset = StandardFrameConstants::kCallerSPOffset +
                                      (num_parameters - 1 - i) * kPointerSize;
           // Load parameter from stack.
           __ movq(rax, Operand(rbp, parameter_offset));
-          // Store it in the context
-          __ movq(Operand(rsi, Context::SlotOffset(slot->index())), rax);
+          // Store it in the context.
+          int context_offset = Context::SlotOffset(slot->index());
+          __ movq(Operand(rsi, context_offset), rax);
+          // Update the write barrier. This clobbers all involved
+          // registers, so we have use a third register to avoid
+          // clobbering rsi.
+          __ movq(rcx, rsi);
+          __ RecordWrite(rcx, context_offset, rax, rbx);
         }
       }
     }
 
     // Possibly allocate an arguments object.
     Variable* arguments = fun->scope()->arguments()->AsVariable();
     if (arguments != NULL) {
       // Arguments object must be allocated after the context object, in
       // case the "arguments" or ".arguments" variables are in the context.
       Comment cmnt(masm_, "[ Allocate arguments object");
       if (function_in_register) {
         __ push(rdi);
       } else {
         __ push(Operand(rbp, JavaScriptFrameConstants::kFunctionOffset));
       }
       // The receiver is just before the parameters on the caller's stack.
       __ lea(rdx, Operand(rbp, StandardFrameConstants::kCallerSPOffset +
-                                   fun->num_parameters() * kPointerSize));
+                          fun->num_parameters() * kPointerSize));
       __ push(rdx);
       __ Push(Smi::FromInt(fun->num_parameters()));
       // Arguments to ArgumentsAccessStub:
       //   function, receiver address, parameter count.
       // The stub will rewrite receiver and parameter count if the previous
       // stack frame was an arguments adapter frame.
       ArgumentsAccessStub stub(ArgumentsAccessStub::NEW_OBJECT);
       __ CallStub(&stub);
       // Store new arguments object in both "arguments" and ".arguments" slots.
       __ movq(rcx, rax);
@@ skipping 1759 matching lines @@
   __ movq(Operand(rsp, 0), rdx);
   // And return.
   __ ret(0);
 }
 
 
 #undef __
 
 
 } }  // namespace v8::internal