Fix deserializer to understand direct pointers from code to cell payloads.

src/serialize.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 224 matching lines @@
   enum HowToCode {
     kPlain = 0,                          // Straight pointer.
     // What this means depends on the architecture:
     kFromCode = 0x40,                    // A pointer inlined in code.
     kHowToCodeMask = 0x40
   };
 
   // Where to point within the object.
   enum WhereToPoint {
     kStartOfObject = 0,
-    kFirstInstruction = 0x80,
+    kInnerPointer = 0x80,  // First insn in code object or payload of cell.
     kWhereToPointMask = 0x80
   };
 
   // Misc.
   // Raw data to be copied from the snapshot.
   static const int kRawData = 0x30;
   // Some common raw lengths: 0x31-0x3f
   // A tag emitted at strategic points in the snapshot to delineate sections.
   // If the deserializer does not find these at the expected moments then it
   // is an indication that the snapshot and the VM do not fit together.
@@ skipping 386 matching lines @@
  private:
   virtual bool ShouldBeInThePartialSnapshotCache(HeapObject* o) {
     return false;
   }
 };
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_SERIALIZE_H_