[heap] Avoid the use of cells to point from code to new-space objects.

src/heap/incremental-marking-inl.h

Index: src/heap/incremental-marking-inl.h
diff --git a/src/heap/incremental-marking-inl.h b/src/heap/incremental-marking-inl.h
index fa22da6d41ecebc06a5f9918c8041e8c10f418dd..3a0c0ad4399597c08b4018ad593cbbf74b5dd287 100644
--- a/src/heap/incremental-marking-inl.h
+++ b/src/heap/incremental-marking-inl.h
@@ -28,8 +28,12 @@ void IncrementalMarking::RecordWriteOfCodeEntry(JSFunction* host, Object** slot,
 
 void IncrementalMarking::RecordWriteIntoCode(Code* host, RelocInfo* rinfo,
                                              Object* value) {
-  if (IsMarking() && value->IsHeapObject()) {
-    RecordWriteIntoCodeSlow(host, rinfo, value);
+  if (value->IsHeapObject()) {
+    if (heap()->InNewSpace(value)) {
+      RecordWriteIntoCodeToNewSpaceSlow(host, rinfo, value);

[ulan, 2016/06/08 14:37:00]

This won't work because RecordWriteIntoCode can be guarded with IsMarking by
callers.

Please inspect callers of RecordWriteIntoCode that are outside of
IncrementalMarking and add Heap::RecordWriteIntoCode() there.

[ahaas, 2016/06/09 10:34:32]

Done.

+    } else if (IsMarking()) {
+      RecordWriteIntoCodeSlow(host, rinfo, value);
+    }
   }
 }