Recorded slots in store buffer are never in free space. Remove migration consistency check.

src/heap/heap.cc

Index: src/heap/heap.cc
diff --git a/src/heap/heap.cc b/src/heap/heap.cc
index 9ea06d26fde69cd1e1a255de435fc1c46315ca40..e88e50f6c395b66220af47d049782f66d8fcc860 100644
--- a/src/heap/heap.cc
+++ b/src/heap/heap.cc
@@ -2118,12 +2118,10 @@ class ScavengingVisitor : public StaticVisitorBase {
       if (alignment != kObjectAlignment) {
         target = EnsureDoubleAligned(heap, target, allocation_size);
       }
+      MigrateObject(heap, object, target, object_size);
 
-      // Order is important: slot might be inside of the target if target
-      // was allocated over a dead object and slot comes from the store
-      // buffer.
+      // Update slot to new target.
       *slot = target;
-      MigrateObject(heap, object, target, object_size);
 
       heap->IncrementSemiSpaceCopiedObjectSize(object_size);
       return true;
@@ -2157,23 +2155,11 @@ class ScavengingVisitor : public StaticVisitorBase {
       if (alignment != kObjectAlignment) {
         target = EnsureDoubleAligned(heap, target, allocation_size);
       }
-
-      // Order is important: slot might be inside of the target if target
-      // was allocated over a dead object and slot comes from the store
-      // buffer.
-
-      // Unfortunately, the allocation can also write over the slot if the slot
-      // was in free space and the allocation wrote free list data (such as the
-      // free list map or entry size) over the slot.  We guard against this by
-      // checking that the slot still points to the object being moved.  This
-      // should be sufficient because neither the free list map nor the free
-      // list entry size should look like a new space pointer (the former is an
-      // old space pointer, the latter is word-aligned).
-      if (*slot == object) {
-        *slot = target;
-      }
       MigrateObject(heap, object, target, object_size);
 
+      // Update slot to new target.
+      *slot = target;
+
       if (object_contents == POINTER_OBJECT) {
         if (map->instance_type() == JS_FUNCTION_TYPE) {
           heap->promotion_queue()->insert(target,