Fix missing write barrier in CopyObjectToObjectElements.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index fa4f943dca48f700965fda5f16d6d0b2fff723af..64d85a0685a98470ad66df6207a6f18f8448eeae 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -8454,7 +8454,7 @@ MaybeObject* JSObject::SetFastElementsCapacityAndLength(
       ? FAST_SMI_ONLY_ELEMENTS
       : FAST_ELEMENTS;
   //  int copy_size = Min(old_elements_raw->length(), new_elements->length());
-  accessor->CopyElements(this, new_elements, to_kind, SKIP_WRITE_BARRIER);
+  accessor->CopyElements(this, new_elements, to_kind);
   if (elements_kind != NON_STRICT_ARGUMENTS_ELEMENTS) {
     set_map_and_elements(new_map, new_elements);
   } else {
@@ -8498,8 +8498,7 @@ MaybeObject* JSObject::SetFastDoubleElementsCapacityAndLength(
   FixedArrayBase* old_elements = elements();
   ElementsKind elements_kind = GetElementsKind();
   ElementsAccessor* accessor = ElementsAccessor::ForKind(elements_kind);
-  accessor->CopyElements(this, elems, FAST_DOUBLE_ELEMENTS,
-                         SKIP_WRITE_BARRIER);
+  accessor->CopyElements(this, elems, FAST_DOUBLE_ELEMENTS);
   if (elements_kind != NON_STRICT_ARGUMENTS_ELEMENTS) {
     set_map_and_elements(new_map, elems);
   } else {