[hydrogen] Add crash-hunting instrumentation to Hydrogen too

src/full-codegen/x64/full-codegen-x64.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_X64
 
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/codegen.h"
 #include "src/compiler.h"
@@ skipping 2239 matching lines @@
   __ Move(LoadDescriptor::NameRegister(), key->value());
   __ Move(LoadDescriptor::SlotRegister(),
           SmiFromSlot(prop->PropertyFeedbackSlot()));
   CallLoadIC(NOT_INSIDE_TYPEOF, language_mode());
 
   // Sanity check: The loaded value must be a JS-exposed kind of object,
   // not something internal (like a Map, or FixedArray). Check this here
   // to chase after a rare but recurring crash bug. It seems to always
   // occur for functions beginning with "this.foo.bar()", so be selective
   // and only insert the check for the first LoadIC (identified by slot).
-  // TODO(jkummerow): Remove this when it has generated a few crash reports.
+  // TODO(chromium:527994): Remove this when we have a few crash reports.
   // Don't forget to remove the Push() above as well!
   if (FeedbackVector()->GetIndex(prop->PropertyFeedbackSlot()) == 6) {
     __ Pop(LoadDescriptor::ReceiverRegister());
 
     Label ok, sound_alarm;
     __ JumpIfSmi(rax, &ok, Label::kNear);
     __ movp(rbx, FieldOperand(rax, HeapObject::kMapOffset));
     __ CompareRoot(rbx, Heap::kMetaMapRootIndex);
     __ j(equal, &sound_alarm);
     __ CompareRoot(rbx, Heap::kFixedArrayMapRootIndex);
@@ skipping 2919 matching lines @@
             Assembler::target_address_at(call_target_address,
                                          unoptimized_code));
   return OSR_AFTER_STACK_CHECK;
 }
 
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_X64