[hydrogen] Add crash-hunting instrumentation to Hydrogen too

src/ic/ic.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/ic/ic.h"
 
 #include "src/accessors.h"
 #include "src/api.h"
 #include "src/arguments.h"
 #include "src/base/bits.h"
@@ skipping 2363 matching lines @@
   // set up outside the IC, handle that here.
   if (vector->GetKind(vector_slot) == Code::LOAD_IC) {
     LoadICNexus nexus(vector, vector_slot);
     LoadIC ic(IC::NO_EXTRA_FRAME, isolate, &nexus);
     ic.UpdateState(receiver, key);
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result, ic.Load(receiver, key));
 
     // Sanity check: The loaded value must be a JS-exposed kind of object,
     // not something internal (like a Map, or FixedArray). Check this here
     // to chase after a rare but recurring crash bug.
-    // TODO(jkummerow): Remove this when it has generated a few crash reports.
+    // TODO(chromium:527994): Remove this when we have a few crash reports.
     if (!result->IsSmi()) {
       InstanceType type =
           Handle<HeapObject>::cast(result)->map()->instance_type();
       CHECK(type <= LAST_PRIMITIVE_TYPE || type >= FIRST_JS_RECEIVER_TYPE);
     }
 
   } else {
     DCHECK(vector->GetKind(vector_slot) == Code::KEYED_LOAD_IC);
     KeyedLoadICNexus nexus(vector, vector_slot);
     KeyedLoadIC ic(IC::NO_EXTRA_FRAME, isolate, &nexus);
@@ skipping 728 matching lines @@
   // set up outside the IC, handle that here.
   if (vector->GetKind(vector_slot) == Code::LOAD_IC) {
     LoadICNexus nexus(vector, vector_slot);
     LoadIC ic(IC::EXTRA_CALL_FRAME, isolate, &nexus);
     ic.UpdateState(receiver, key);
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result, ic.Load(receiver, key));
 
     // Sanity check: The loaded value must be a JS-exposed kind of object,
     // not something internal (like a Map, or FixedArray). Check this here
     // to chase after a rare but recurring crash bug.
-    // TODO(jkummerow): Remove this when it has generated a few crash reports.
+    // TODO(chromium:527994): Remove this when we have a few crash reports.
     if (!result->IsSmi()) {
       InstanceType type =
           Handle<HeapObject>::cast(result)->map()->instance_type();
       CHECK(type <= LAST_PRIMITIVE_TYPE || type >= FIRST_JS_RECEIVER_TYPE);
     }
 
   } else {
     DCHECK(vector->GetKind(vector_slot) == Code::KEYED_LOAD_IC);
     KeyedLoadICNexus nexus(vector, vector_slot);
     KeyedLoadIC ic(IC::EXTRA_CALL_FRAME, isolate, &nexus);
     ic.UpdateState(receiver, key);
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result, ic.Load(receiver, key));
   }
 
   return *result;
 }
 }  // namespace internal
 }  // namespace v8