A reviewer of ttps://github.com/openjdk/jdk/pull/20395 asks the question:

T might mean either oop or narrowOop. Yet, we are calling write_ref_array with HeapWord* and length, which is here a count of either oop or narrowOop-s. So for narrowOop, which is smaller than HeapWord, we call write_ref_array with double the length?

Note how ShenandoahBarrierSet::arraycopy_barrier carries T* src, size_t count all the way down to ShenandoahBarrierSet::arraycopy_work to avoid this problem. I think write_ref_array should really carry overloads for write_ref_array(oop* src, size_t count) and write_ref_array(narrowOop* src, size_t count).