Merge bleeding edge up to 9192 into the GC branch.

src/heap-inl.h

Index: src/heap-inl.h
diff --git a/src/heap-inl.h b/src/heap-inl.h
index 9122aa599d98b3f50932704f6c39f0e94d7d4004..4bd893e8eedf839f6dc232346812ab26a3bf312f 100644
--- a/src/heap-inl.h
+++ b/src/heap-inl.h
@@ -346,10 +346,10 @@ AllocationSpace Heap::TargetSpaceId(InstanceType type) {
   ASSERT(type != JS_GLOBAL_PROPERTY_CELL_TYPE);
 
   if (type < FIRST_NONSTRING_TYPE) {
-    // There are three string representations: sequential strings, cons
-    // strings, and external strings.  Only cons strings contain
-    // non-map-word pointers to heap objects.
-    return ((type & kStringRepresentationMask) == kConsStringTag)
+    // There are four string representations: sequential strings, external
+    // strings, cons strings, and sliced strings.
+    // Only the latter two contain non-map-word pointers to heap objects.
+    return ((type & kIsIndirectStringMask) == kIsIndirectStringTag)
         ? OLD_POINTER_SPACE
         : OLD_DATA_SPACE;
   } else {