Don't access PagedSpace::executability after the object has been destroyed

src/spaces.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 598 matching lines @@
   // We cannot free a chunk contained in the initial chunk because it was not
   // allocated with AllocateRawMemory.  Instead we uncommit the virtual
   // memory.
   if (InInitialChunk(c.address())) {
     // TODO(1240712): VirtualMemory::Uncommit has a return value which
     // is ignored here.
     initial_chunk_->Uncommit(c.address(), c.size());
     Counters::memory_allocated.Decrement(static_cast<int>(c.size()));
   } else {
     LOG(DeleteEvent("PagedChunk", c.address()));
-    FreeRawMemory(c.address(), c.size(), c.owner()->executable());
+    FreeRawMemory(c.address(), c.size(), c.executable());
   }
   c.init(NULL, 0, NULL);
   Push(chunk_id);
 }
 
 
 Page* MemoryAllocator::FindFirstPageInSameChunk(Page* p) {
   int chunk_id = GetChunkId(p);
   ASSERT(IsValidChunk(chunk_id));
 
@@ skipping 2346 matching lines @@
   for (HeapObject* obj = obj_it.next(); obj != NULL; obj = obj_it.next()) {
     if (obj->IsCode()) {
       Code* code = Code::cast(obj);
       code_kind_statistics[code->kind()] += code->Size();
     }
   }
 }
 #endif  // DEBUG
 
 } }  // namespace v8::internal