Fix candidate eviction in code flusher.

src/mark-compact.cc

Index: src/mark-compact.cc
diff --git a/src/mark-compact.cc b/src/mark-compact.cc
index a92bcca3721e84f1891e3f4c47abb30414b02f49..8ca14db5063ea5122c25e7414d96f0700b4b3b4c 100644
--- a/src/mark-compact.cc
+++ b/src/mark-compact.cc
@@ -939,6 +939,10 @@ void CodeFlusher::EvictCandidate(JSFunction* function) {
   ASSERT(!function->next_function_link()->IsUndefined());
   Object* undefined = isolate_->heap()->undefined_value();
 
+  // The function is no longer a candidate, make sure it gets visited
+  // again so that previous flushing decisions are revisited.
+  isolate_->heap()->incremental_marking()->RecordWrites(function);
+
   JSFunction* candidate = jsfunction_candidates_head_;
   JSFunction* next_candidate;
   if (candidate == function) {