Do not patch IC in deoptimized code.

src/ic/ic-inl.h

Index: src/ic/ic-inl.h
diff --git a/src/ic/ic-inl.h b/src/ic/ic-inl.h
index b0decf4c6a393b88ac332c82367c2974ccbebfa0..4db1b39510629e0753c4b0980ed1f0a49c10deb9 100644
--- a/src/ic/ic-inl.h
+++ b/src/ic/ic-inl.h
@@ -95,6 +95,8 @@ Code* IC::GetTargetAtAddress(Address address,
 
 void IC::SetTargetAtAddress(Address address, Code* target,
                             ConstantPoolArray* constant_pool) {
+  if (AddressIsDeoptimizedCode(target->GetIsolate(), address)) return;
+
   DCHECK(target->is_inline_cache_stub() || target->is_compare_ic_stub());
 
   // Don't use this for load_ics when --vector-ics is turned on.
@@ -212,12 +214,25 @@ Handle<Map> IC::GetICCacheHolder(Handle<Map> map, Isolate* isolate,
 }
 
 
-inline Code* IC::get_host() {
+Code* IC::get_host() {
   return isolate()
       ->inner_pointer_to_code_cache()
       ->GetCacheEntry(address())
       ->code;
 }
+
+
+bool IC::AddressIsDeoptimizedCode() const {
+  return AddressIsDeoptimizedCode(isolate(), address());
+}
+
+
+bool IC::AddressIsDeoptimizedCode(Isolate* isolate, Address address) {
+  Code* host =
+      isolate->inner_pointer_to_code_cache()->GetCacheEntry(address)->code;
+  return (host->kind() == Code::OPTIMIZED_FUNCTION &&
+          host->marked_for_deoptimization());
+}
 }
 }  // namespace v8::internal