Index: src/heap/heap.cc |
diff --git a/src/heap/heap.cc b/src/heap/heap.cc |
index 9ea06d26fde69cd1e1a255de435fc1c46315ca40..e88e50f6c395b66220af47d049782f66d8fcc860 100644 |
--- a/src/heap/heap.cc |
+++ b/src/heap/heap.cc |
@@ -2118,12 +2118,10 @@ class ScavengingVisitor : public StaticVisitorBase { |
if (alignment != kObjectAlignment) { |
target = EnsureDoubleAligned(heap, target, allocation_size); |
} |
+ MigrateObject(heap, object, target, object_size); |
- // Order is important: slot might be inside of the target if target |
- // was allocated over a dead object and slot comes from the store |
- // buffer. |
+ // Update slot to new target. |
*slot = target; |
- MigrateObject(heap, object, target, object_size); |
heap->IncrementSemiSpaceCopiedObjectSize(object_size); |
return true; |
@@ -2157,23 +2155,11 @@ class ScavengingVisitor : public StaticVisitorBase { |
if (alignment != kObjectAlignment) { |
target = EnsureDoubleAligned(heap, target, allocation_size); |
} |
- |
- // Order is important: slot might be inside of the target if target |
- // was allocated over a dead object and slot comes from the store |
- // buffer. |
- |
- // Unfortunately, the allocation can also write over the slot if the slot |
- // was in free space and the allocation wrote free list data (such as the |
- // free list map or entry size) over the slot. We guard against this by |
- // checking that the slot still points to the object being moved. This |
- // should be sufficient because neither the free list map nor the free |
- // list entry size should look like a new space pointer (the former is an |
- // old space pointer, the latter is word-aligned). |
- if (*slot == object) { |
- *slot = target; |
- } |
MigrateObject(heap, object, target, object_size); |
+ // Update slot to new target. |
+ *slot = target; |
+ |
if (object_contents == POINTER_OBJECT) { |
if (map->instance_type() == JS_FUNCTION_TYPE) { |
heap->promotion_queue()->insert(target, |