Fix bug in PointersUpdatingVisitor::UpdatePointer.

src/mark-compact.cc

Index: src/mark-compact.cc
diff --git a/src/mark-compact.cc b/src/mark-compact.cc
index 54a293685f2875b2a8935b6586b0cfe0788acc18..422d44b307af2d7e4bc444f1e148ec339234808f 100644
--- a/src/mark-compact.cc
+++ b/src/mark-compact.cc
@@ -244,7 +244,10 @@ bool MarkCompactCollector::StartCompaction() {
 
     CollectEvacuationCandidates(heap()->old_pointer_space());
     CollectEvacuationCandidates(heap()->old_data_space());
-    CollectEvacuationCandidates(heap()->code_space());
+
+    if (FLAG_compact_code_space) {
+      CollectEvacuationCandidates(heap()->code_space());
+    }
 
     heap()->old_pointer_space()->EvictEvacuationCandidatesFromFreeLists();
     heap()->old_data_space()->EvictEvacuationCandidatesFromFreeLists();
@@ -480,7 +483,7 @@ void MarkCompactCollector::Prepare(GCTracer* tracer) {
   ASSERT(state_ == IDLE);
   state_ = PREPARE_GC;
 #endif
-  ASSERT(!FLAG_always_compact || !FLAG_never_compact);
+  if (FLAG_never_compact) FLAG_always_compact = false;
 
   if (collect_maps_) CreateBackPointers();
 #ifdef ENABLE_GDB_JIT_INTERFACE
@@ -2451,11 +2454,13 @@ class PointersUpdatingVisitor: public ObjectVisitor {
 
     HeapObject* obj = HeapObject::cast(*p);
 
-    if (heap_->InNewSpace(obj) ||
-        MarkCompactCollector::IsOnEvacuationCandidate(obj)) {
-      ASSERT(obj->map_word().IsForwardingAddress());
+    MapWord map_word = obj->map_word();
+    if (map_word.IsForwardingAddress()) {
+      ASSERT(heap_->InFromSpace(obj) ||
+             MarkCompactCollector::IsOnEvacuationCandidate(obj));
       *p = obj->map_word().ToForwardingAddress();
-      ASSERT(!MarkCompactCollector::IsOnEvacuationCandidate(*p));
+      ASSERT(!heap_->InFromSpace(*p) &&
+             !MarkCompactCollector::IsOnEvacuationCandidate(*p));
     }
   }