Fix bug in PointersUpdatingVisitor::UpdatePointer.

src/mark-compact.cc

Index: src/mark-compact.cc
diff --git a/src/mark-compact.cc b/src/mark-compact.cc
index e5178ecbfe0cd5f2d3f6b5db02d5a3b81efd8963..422d44b307af2d7e4bc444f1e148ec339234808f 100644
--- a/src/mark-compact.cc
+++ b/src/mark-compact.cc
@@ -483,7 +483,7 @@ void MarkCompactCollector::Prepare(GCTracer* tracer) {
   ASSERT(state_ == IDLE);
   state_ = PREPARE_GC;
 #endif
-  ASSERT(!FLAG_always_compact || !FLAG_never_compact);
+  if (FLAG_never_compact) FLAG_always_compact = false;
 
   if (collect_maps_) CreateBackPointers();
 #ifdef ENABLE_GDB_JIT_INTERFACE
@@ -2454,11 +2454,13 @@ class PointersUpdatingVisitor: public ObjectVisitor {
 
     HeapObject* obj = HeapObject::cast(*p);
 
-    if (heap_->InNewSpace(obj) ||
-        MarkCompactCollector::IsOnEvacuationCandidate(obj)) {
-      ASSERT(obj->map_word().IsForwardingAddress());
+    MapWord map_word = obj->map_word();
+    if (map_word.IsForwardingAddress()) {
+      ASSERT(heap_->InFromSpace(obj) ||
+             MarkCompactCollector::IsOnEvacuationCandidate(obj));
       *p = obj->map_word().ToForwardingAddress();
-      ASSERT(!MarkCompactCollector::IsOnEvacuationCandidate(*p));
+      ASSERT(!heap_->InFromSpace(*p) &&
+             !MarkCompactCollector::IsOnEvacuationCandidate(*p));
     }
   }