[heap] Avoid the use of cells to point from code to new-space objects.

src/heap/incremental-marking-inl.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_HEAP_INCREMENTAL_MARKING_INL_H_
 #define V8_HEAP_INCREMENTAL_MARKING_INL_H_
 
 #include "src/heap/incremental-marking.h"
 
 namespace v8 {
@@ skipping 10 matching lines @@
 
 void IncrementalMarking::RecordWriteOfCodeEntry(JSFunction* host, Object** slot,
                                                 Code* value) {
   if (IsMarking()) {
     RecordWriteOfCodeEntrySlow(host, slot, value);
   }
 }
 
 void IncrementalMarking::RecordWriteIntoCode(Code* host, RelocInfo* rinfo,
                                              Object* value) {
-  if (IsMarking() && value->IsHeapObject()) {
-    RecordWriteIntoCodeSlow(host, rinfo, value);
+  if (value->IsHeapObject()) {
+    if (heap()->InNewSpace(value)) {
+      RecordWriteIntoCodeToNewSpaceSlow(host, rinfo, value);

[ulan, 2016/06/08 14:37:00]

This won't work because RecordWriteIntoCode can be guarded with IsMarking by
callers.

Please inspect callers of RecordWriteIntoCode that are outside of
IncrementalMarking and add Heap::RecordWriteIntoCode() there.

[ahaas, 2016/06/09 10:34:32]

Done.

+    } else if (IsMarking()) {
+      RecordWriteIntoCodeSlow(host, rinfo, value);
+    }
   }
 }
 
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_HEAP_INCREMENTAL_MARKING_INL_H_