Set promotion queue limit before migrating object.

src/heap.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
 #include "src/api.h"
 #include "src/base/once.h"
 #include "src/bootstrapper.h"
@@ skipping 1974 matching lines @@
     ASSERT(heap->AllowedToBeMigrated(object, NEW_SPACE));
     AllocationResult allocation =
         heap->new_space()->AllocateRaw(allocation_size);
 
     HeapObject* target = NULL;  // Initialization to please compiler.
     if (allocation.To(&target)) {
       if (alignment != kObjectAlignment) {
         target = EnsureDoubleAligned(heap, target, allocation_size);
       }
 
+      // Order is important here: Set the promotion limit before migrating
+      // the object. Otherwise we may end up overwriting promotion queue
+      // entries when we migrate the object.
+      heap->promotion_queue()->SetNewLimit(heap->new_space()->top());
+
       // Order is important: slot might be inside of the target if target
       // was allocated over a dead object and slot comes from the store
       // buffer.
       *slot = target;
       MigrateObject(heap, object, target, object_size);
 
-      heap->promotion_queue()->SetNewLimit(heap->new_space()->top());
       heap->IncrementSemiSpaceCopiedObjectSize(object_size);
       return true;
     }
     return false;
   }
 
 
   template<ObjectContents object_contents, int alignment>
   static inline bool PromoteObject(Map* map,
                                    HeapObject** slot,
@@ skipping 4426 matching lines @@
       static_cast<int>(object_sizes_last_time_[index]));
   CODE_AGE_LIST_COMPLETE(ADJUST_LAST_TIME_OBJECT_COUNT)
 #undef ADJUST_LAST_TIME_OBJECT_COUNT
 
   MemCopy(object_counts_last_time_, object_counts_, sizeof(object_counts_));
   MemCopy(object_sizes_last_time_, object_sizes_, sizeof(object_sizes_));
   ClearObjectStats();
 }
 
 } }  // namespace v8::internal