Invalidate embedded objects in optimized code if it was marked for deoptimization.

Invalidate embedded objects in optimized code if it was marked for deoptimization.

It avoids having dead pointers in code from the time it was marked for deoptimization until it is deoptimized.

BUG=320532, v8:2996
TEST=mjsunit/regress/regress-320532.js
LOG=Y
R=danno@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=18013

[ulan, 2013-11-19 10:40:26]

PTAL

https://chromiumcodereview.appspot.com/61213012/diff/30001/src/objects.cc
File src/objects.cc (right):

https://chromiumcodereview.appspot.com/61213012/diff/30001/src/objects.cc#new...
src/objects.cc:10384: it.rinfo()->set_target_object(undefined,
SKIP_WRITE_BARRIER);
We cannot put smi(0) here because, target object has to heap object.

[mvstanton, 2013-11-19 11:15:02]

DBC: Kind of a nit, but is it necessary to pass the undefined object? Why not
get it from GetHeap()->undefined_value() in the method. Alternatively,
ASSERT(undefined->IsUndefined()).

[ulan, 2013-11-19 11:33:38]

> Why not get it from GetHeap()->undefined_value() in the method.
Done. Thanks for suggestion.

[danno, 2013-11-22 12:39:26]

lgtm

[ulan, 2013-11-22 13:10:37]

Committed patchset #2 manually as r18013 (presubmit successful).