Fix bug in PointersUpdatingVisitor::UpdatePointer.

It was updating the same pointer twice (was using InNewSpace instead of
InFromSpace).

Also make FLAG_never_compact supercede FLAG_always_compact.

R=erik.corry@gmail.com
BUG=v8:1721

Review URL: http://codereview.chromium.org/8041017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9423 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/mark-compact.cc

@@ -483,7 +483,9 @@ void MarkCompactCollector::Prepare(GCTracer* tracer) {
   ASSERT(state_ == IDLE);
   state_ = PREPARE_GC;
 #endif
-  ASSERT(!FLAG_always_compact || !FLAG_never_compact);
+
+  // TODO(1726) Revert this into an assertion when compaction is enabled.
+  if (FLAG_never_compact) FLAG_always_compact = false;
 
   if (collect_maps_) CreateBackPointers();
 #ifdef ENABLE_GDB_JIT_INTERFACE
@@ -2454,11 +2456,13 @@ class PointersUpdatingVisitor: public ObjectVisitor {
 
     HeapObject* obj = HeapObject::cast(*p);
 
-    if (heap_->InNewSpace(obj) ||
-        MarkCompactCollector::IsOnEvacuationCandidate(obj)) {
-      ASSERT(obj->map_word().IsForwardingAddress());
+    MapWord map_word = obj->map_word();
+    if (map_word.IsForwardingAddress()) {
+      ASSERT(heap_->InFromSpace(obj) ||
+             MarkCompactCollector::IsOnEvacuationCandidate(obj));
       *p = obj->map_word().ToForwardingAddress();
-      ASSERT(!MarkCompactCollector::IsOnEvacuationCandidate(*p));
+      ASSERT(!heap_->InFromSpace(*p) &&
+             !MarkCompactCollector::IsOnEvacuationCandidate(*p));
     }
   }