[heap] Fix corner case in optimized code map processing.

src/heap/objects-visiting-inl.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_OBJECTS_VISITING_INL_H_
 #define V8_OBJECTS_VISITING_INL_H_
 
 #include "src/heap/array-buffer-tracker.h"
 #include "src/heap/objects-visiting.h"
 #include "src/ic/ic-state.h"
@@ skipping 410 matching lines @@
 
 
 template <typename StaticVisitor>
 void StaticMarkingVisitor<StaticVisitor>::VisitCode(Map* map,
                                                     HeapObject* object) {
   Heap* heap = map->GetHeap();
   Code* code = Code::cast(object);
   if (FLAG_age_code && !heap->isolate()->serializer_enabled()) {
     code->MakeOlder(heap->mark_compact_collector()->marking_parity());
   }
+  MarkCompactCollector* collector = heap->mark_compact_collector();
+  if (collector->is_code_flushing_enabled()) {
+    if (code->kind() == Code::OPTIMIZED_FUNCTION) {
+      // Visit all unoptimized code objects to prevent flushing them.
+      MarkInlinedFunctionsCode(heap, code);
+    }
+  }
   code->CodeIterateBody<StaticVisitor>(heap);
 }
 
 
 template <typename StaticVisitor>
 void StaticMarkingVisitor<StaticVisitor>::VisitSharedFunctionInfo(
     Map* map, HeapObject* object) {
   Heap* heap = map->GetHeap();
   SharedFunctionInfo* shared = SharedFunctionInfo::cast(object);
   if (shared->ic_age() != heap->global_ic_age()) {
@@ skipping 63 matching lines @@
       if (StaticVisitor::MarkObjectWithoutPush(heap, shared)) {
         StaticVisitor::MarkObject(heap, shared->map());
         VisitSharedFunctionInfoWeakCode(heap, shared);
       }
       // Treat the reference to the code object weakly.
       VisitJSFunctionWeakCode(heap, object);
       return;
     } else {
       // Visit all unoptimized code objects to prevent flushing them.
       StaticVisitor::MarkObject(heap, function->shared()->code());
-      if (function->code()->kind() == Code::OPTIMIZED_FUNCTION) {
-        MarkInlinedFunctionsCode(heap, function->code());
-      }
     }
   }
   VisitJSFunctionStrongCode(heap, object);
 }
 
 
 template <typename StaticVisitor>
 void StaticMarkingVisitor<StaticVisitor>::VisitJSRegExp(Map* map,
                                                         HeapObject* object) {
   int last_property_offset =
@@ skipping 121 matching lines @@
   }
 }
 
 
 template <typename StaticVisitor>
 void StaticMarkingVisitor<StaticVisitor>::MarkInlinedFunctionsCode(Heap* heap,
                                                                    Code* code) {
   // For optimized functions we should retain both non-optimized version
   // of its code and non-optimized version of all inlined functions.
   // This is required to support bailing out from inlined code.
-  DeoptimizationInputData* const data =
-      DeoptimizationInputData::cast(code->deoptimization_data());
-  FixedArray* const literals = data->LiteralArray();
-  int const inlined_count = data->InlinedFunctionCount()->value();
-  for (int i = 0; i < inlined_count; ++i) {
-    StaticVisitor::MarkObject(
-        heap, SharedFunctionInfo::cast(literals->get(i))->code());
+  if (code->deoptimization_data() != heap->empty_fixed_array()) {
+    DeoptimizationInputData* const data =
+        DeoptimizationInputData::cast(code->deoptimization_data());
+    FixedArray* const literals = data->LiteralArray();
+    int const inlined_count = data->InlinedFunctionCount()->value();
+    for (int i = 0; i < inlined_count; ++i) {
+      StaticVisitor::MarkObject(
+          heap, SharedFunctionInfo::cast(literals->get(i))->code());
+    }
   }
 }
 
 
 inline static bool HasValidNonBuiltinContext(JSFunction* function) {
   return function->context()->IsContext() && !function->shared()->IsBuiltin();
 }
 
 
 inline static bool HasSourceCode(Heap* heap, SharedFunctionInfo* info) {
@@ skipping 222 matching lines @@
 
   RelocIterator it(this, mode_mask);
   for (; !it.done(); it.next()) {
     it.rinfo()->template Visit<StaticVisitor>(heap);
   }
 }
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_OBJECTS_VISITING_INL_H_