[heap] fix crash during the scavenge of ArrayBuffer

src/heap/scavenger.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/heap/scavenger.h"
 
 #include "src/contexts.h"
 #include "src/heap/heap.h"
 #include "src/heap/objects-visiting-inl.h"
 #include "src/heap/scavenger-inl.h"
@@ skipping 292 matching lines @@
     DCHECK(map_word.IsForwardingAddress());
     FixedTypedArrayBase* target =
         reinterpret_cast<FixedTypedArrayBase*>(map_word.ToForwardingAddress());
     if (target->base_pointer() != Smi::FromInt(0))
       target->set_base_pointer(target, SKIP_WRITE_BARRIER);
   }
 
 
   static inline void EvacuateJSArrayBuffer(Map* map, HeapObject** slot,
                                            HeapObject* object) {
-    ObjectEvacuationStrategy<POINTER_OBJECT>::Visit(map, slot, object);
+    ObjectEvacuationStrategy<DATA_OBJECT>::Visit(map, slot, object);
 
     Heap* heap = map->GetHeap();
     MapWord map_word = object->map_word();
     DCHECK(map_word.IsForwardingAddress());
     HeapObject* target = map_word.ToForwardingAddress();
     if (!heap->InNewSpace(target)) {
       heap->array_buffer_tracker()->Promote(JSArrayBuffer::cast(target));
     }
   }
 
@@ skipping 163 matching lines @@
 
 void ScavengeVisitor::ScavengePointer(Object** p) {
   Object* object = *p;
   if (!heap_->InNewSpace(object)) return;
   Scavenger::ScavengeObject(reinterpret_cast<HeapObject**>(p),
                             reinterpret_cast<HeapObject*>(object));
 }
 
 }  // namespace internal
 }  // namespace v8