[vm, gc] Fix backwards write-barrier logic used by Object::Clone.

Change-Id: Ib614c0e85a96604252a47ad81ad6a8e70509a671
Reviewed-on: https://dart-review.googlesource.com/c/91242
Reviewed-by: Siva Annamalai <asiva@google.com>
Commit-Queue: Ryan Macnak <rmacnak@google.com>
diff --git a/runtime/vm/object.cc b/runtime/vm/object.cc
index 607d5b4..e0072d7 100644
--- a/runtime/vm/object.cc
+++ b/runtime/vm/object.cc
@@ -2082,14 +2082,14 @@
       for (RawObject** slot = from; slot <= to; ++slot) {
         RawObject* value = *slot;
         if (value->IsHeapObject()) {
-          old_obj_->CheckHeapPointerStore(value, thread_);
+          old_obj_->CheckArrayPointerStore(slot, value, thread_);
         }
       }
     } else {
       for (RawObject** slot = from; slot <= to; ++slot) {
         RawObject* value = *slot;
         if (value->IsHeapObject()) {
-          old_obj_->CheckArrayPointerStore(slot, value, thread_);
+          old_obj_->CheckHeapPointerStore(value, thread_);
         }
       }
     }