Record code slots that may point to evacuation candidate objects after deoptimizing them.

src/deoptimizer.cc

Index: src/deoptimizer.cc
diff --git a/src/deoptimizer.cc b/src/deoptimizer.cc
index 3ab10fcac905871da62fafd9cf9f658e1e7e7d48..684a37ff87ee10abe9b965a390a12c51f22f0414 100644
--- a/src/deoptimizer.cc
+++ b/src/deoptimizer.cc
@@ -414,9 +414,11 @@ void Deoptimizer::DeoptimizeMarkedCodeForContext(Context* context) {
     PatchCodeForDeoptimization(isolate, codes[i]);
 
     // We might be in the middle of incremental marking with compaction.
-    // Ignore all slots that might have been recorded on the deoptimized code
-    // object.
-    isolate->heap()->mark_compact_collector()->RemoveObjectSlots(codes[i]);
+    // Ignore all slots that might have been recorded in the body of the
+    // deoptimized code object.
+    Code* code = codes[i];
+    isolate->heap()->mark_compact_collector()->RemoveObjectSlots(
+        code->instruction_start(), code->address() + code->Size());
   }
 }