Fix bug in PointersUpdatingVisitor::UpdatePointer.

src/mark-compact.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 465 matching lines @@
   collect_maps_ = FLAG_collect_maps && !was_marked_incrementally_;
 
   // Rather than passing the tracer around we stash it in a static member
   // variable.
   tracer_ = tracer;
 
 #ifdef DEBUG
   ASSERT(state_ == IDLE);
   state_ = PREPARE_GC;
 #endif
-  ASSERT(!FLAG_always_compact || !FLAG_never_compact);
+  if (FLAG_never_compact) FLAG_always_compact = false;
 
   if (collect_maps_) CreateBackPointers();
 #ifdef ENABLE_GDB_JIT_INTERFACE
   if (FLAG_gdbjit) {
     // If GDBJIT interface is active disable compaction.
     compacting_collection_ = false;
   }
 #endif
 
   // Clear marking bits for precise sweeping to collect all garbage.
@@ skipping 1950 matching lines @@
     VisitPointer(&target);
     rinfo->set_call_address(Code::cast(target)->instruction_start());
   }
 
  private:
   inline void UpdatePointer(Object** p) {
     if (!(*p)->IsHeapObject()) return;
 
     HeapObject* obj = HeapObject::cast(*p);
 
-    if (heap_->InNewSpace(obj) ||
-        MarkCompactCollector::IsOnEvacuationCandidate(obj)) {
-      ASSERT(obj->map_word().IsForwardingAddress());
+    MapWord map_word = obj->map_word();
+    if (map_word.IsForwardingAddress()) {
+      ASSERT(heap_->InFromSpace(obj) ||
+             MarkCompactCollector::IsOnEvacuationCandidate(obj));
       *p = obj->map_word().ToForwardingAddress();
-      ASSERT(!MarkCompactCollector::IsOnEvacuationCandidate(*p));
+      ASSERT(!heap_->InFromSpace(*p) &&
+             !MarkCompactCollector::IsOnEvacuationCandidate(*p));
     }
   }
 
   Heap* heap_;
 };
 
 
 static void UpdatePointer(HeapObject** p, HeapObject* object) {
   ASSERT(*p == object);
 
@@ skipping 1359 matching lines @@
   while (buffer != NULL) {
     SlotsBuffer* next_buffer = buffer->next();
     DeallocateBuffer(buffer);
     buffer = next_buffer;
   }
   *buffer_address = NULL;
 }
 
 
 } }  // namespace v8::internal