The comment at the top of class MapWord in src/objects/objects.h explains it:
// Heap objects typically have a map pointer in their first word. However,
// during GC other data (e.g. mark bits, forwarding addresses) is sometimes
// encoded in the first word. The class MapWord is an abstraction of the
// value in a heap object's first word.
More specifically, when MapWord::IsForwardingAddress() returns true,
the map word is a SMI, not a HeapObject (i.e., bit 0 is clear.)
I'm not 100% sure but I think that condition can arise during both
minor and major GCs.