Do not touch a binary op IC target in code object marked for lazy deopt.

Bad scenario:

- Enter a binop IC miss handler from optimized code object C from call
  site S,

- From the binop IC, invoke arbitrary javascript that lazy deopts C,
  so all relocation info is nuked and replaced with lazy deopt entries'
  reloc info. In particular, there is no reloc info for S.

- Still from the arbitrary JavaScript, make IC target's code object move.
  Note that the call site S is not updated.

- Return to the miss handler and inspect the IC's target. This will try
  to get the target from S, but that is a potentially invalid pointer.

It is quite possible that we will have to do a similar fix for other ICs,
but we will have to find a reliable repro first. I am not submitting a
repro here because it is quite long running and brittle (it
relies on code compaction happening while in the binop IC).

BUG=v8:3910
LOG=n
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/958473004

Cr-Commit-Position: refs/heads/master@{#26872}

src/ic/ic.cc

@@ -230,6 +230,14 @@ bool IC::AddressIsOptimizedCode() const {
 }
 
 
+bool IC::AddressIsDeoptimizedCode() const {
+  Code* host =
+      isolate()->inner_pointer_to_code_cache()->GetCacheEntry(address())->code;
+  return host->kind() == Code::OPTIMIZED_FUNCTION &&
+         host->marked_for_deoptimization();
+}
+
+
 static void LookupForRead(LookupIterator* it) {
   for (; it->IsFound(); it->Next()) {
     switch (it->state()) {
@@ -2516,9 +2524,17 @@ MaybeHandle<Object> BinaryOpIC::Transition(
       isolate(), result, Execution::Call(isolate(), function, left, 1, &right),
       Object);
 
+  // Do not try to update the target if the code was marked for lazy
+  // deoptimization. (Since we do not relocate addresses in these
+  // code objects, an attempt to access the target could fail.)
+  if (AddressIsDeoptimizedCode()) {
+    return result;
+  }
+
   // Execution::Call can execute arbitrary JavaScript, hence potentially
   // update the state of this very IC, so we must update the stored state.
   UpdateTarget();
+
   // Compute the new state.
   BinaryOpICState old_state(isolate(), target()->extra_ic_state());
   state.Update(left, right, result);

src/ic/ic.h

@@ -134,6 +134,7 @@ class IC {
   Code* GetOriginalCode() const;
 
   bool AddressIsOptimizedCode() const;
+  bool AddressIsDeoptimizedCode() const;
 
   // Set the call-site target.
   inline void set_target(Code* code);