Fix shared function info code replacement.

src/mark-compact.cc

Index: src/mark-compact.cc
diff --git a/src/mark-compact.cc b/src/mark-compact.cc
index 3ebdb1e6b734e7c6ee5de269ddfb68b46475cdd8..f23b74313dc37006dacafdbb96ebf4f7f888c713 100644
--- a/src/mark-compact.cc
+++ b/src/mark-compact.cc
@@ -885,8 +885,8 @@ void CodeFlusher::ProcessJSFunctionCandidates() {
     if (!code_mark.Get()) {
       shared->set_code(lazy_compile);
       candidate->set_code(lazy_compile);
-    } else if (code == lazy_compile) {
-      candidate->set_code(lazy_compile);
+    } else {
+      candidate->set_code(code);
     }
 
     // We are in the middle of a GC cycle so the write barrier in the code
@@ -935,6 +935,35 @@ void CodeFlusher::ProcessSharedFunctionInfoCandidates() {
 }
 
 
+void CodeFlusher::EvictCandidate(SharedFunctionInfo* shared_info) {
+  ASSERT(shared_info->code()->gc_metadata() != NULL);
+
+  // The function is no longer a candidate, make sure it gets visited
+  // again so that previous flushing decisions are revisited.
+  isolate_->heap()->incremental_marking()->RecordWrites(shared_info);
+
+  SharedFunctionInfo* candidate = shared_function_info_candidates_head_;
+  SharedFunctionInfo* next_candidate;

[Hannes Payer (out of office), 2013/01/11 10:09:51]

Why is there a difference between shared_info being the head of the list and
being somewhere on the list? Moreover can you unify the code below?

[Michael Starzinger, 2013/01/11 12:27:22]

The head needs to be handles specially, because it is stored as a field inside
the code-flusher (i.e. in the shared_function_info_candidates_head_ field).

+  if (candidate == shared_info) {
+    next_candidate = GetNextCandidate(shared_info);
+    shared_function_info_candidates_head_ = next_candidate;
+    ClearNextCandidate(shared_info);
+  } else {
+    while (candidate != NULL) {
+      next_candidate = GetNextCandidate(candidate);
+
+      if (next_candidate == shared_info) {
+        next_candidate = GetNextCandidate(shared_info);
+        SetNextCandidate(candidate, next_candidate);
+        ClearNextCandidate(shared_info);

[Michael Starzinger, 2013/01/11 12:27:22]

As discussed offline, I added a break here.

+      }
+
+      candidate = next_candidate;
+    }
+  }
+}
+
+
 void CodeFlusher::EvictCandidate(JSFunction* function) {
   ASSERT(!function->next_function_link()->IsUndefined());
   Object* undefined = isolate_->heap()->undefined_value();