[deoptimizer] Use the correct function for handler lookup for bytecode.

BUG=chromium:668760

Review-Url: https://codereview.chromium.org/2530403002
Cr-Commit-Position: refs/heads/master@{#41314}

src/deoptimizer.cc

@@ -646,9 +646,9 @@ int LookupCatchHandler(TranslatedFrame* translated_frame, int* data_out) {
       JSFunction* function =
           JSFunction::cast(translated_frame->begin()->GetRawValue());
       BytecodeArray* bytecode = function->shared()->bytecode_array();
-      HandlerTable* table = HandlerTable::cast(bytecode->handler_table());
       HandlerTable::CatchPrediction prediction;
-      return table->LookupRange(bytecode_offset, data_out, &prediction);
+      return bytecode->LookupRangeInHandlerTable(bytecode_offset, data_out,
+                                                 &prediction);
     }
     default:
       break;

test/mjsunit/compiler/regress-668760.js

@@ -0,0 +1,28 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  try {
+    o;
+  } catch (e) {
+    return e;
+  }
+  return 0;
+}
+
+function deopt() {
+  %DeoptimizeFunction(f);
+  throw 42;
+}
+
+%NeverOptimizeFunction(deopt);
+
+this.__defineGetter__("o", deopt );
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+assertEquals(42, f());