[deoptimizer] When deoptimizing code, unlink all functions referring to that code.

test/mjsunit/regress/regress-unlink-closures-on-deopt.js

Index: test/mjsunit/regress/regress-unlink-closures-on-deopt.js
diff --git a/test/mjsunit/regress/regress-unlink-closures-on-deopt.js b/test/mjsunit/regress/regress-unlink-closures-on-deopt.js
new file mode 100644
index 0000000000000000000000000000000000000000..b7fa2b1a754e5b91c8ee39875787150ee0be4afe
--- /dev/null
+++ b/test/mjsunit/regress/regress-unlink-closures-on-deopt.js
@@ -0,0 +1,37 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --noalways-opt
+
+function foo() {
+  function g(o) {
+    return o.f;
+  }
+  return g;
+}
+
+let g1 = foo();
+let g2 = foo();
+
+g1({ f : 1});
+g1({ f : 2});
+g2({ f : 2});
+g2({ f : 2});
+
+%OptimizeFunctionOnNextCall(g1);
+%OptimizeFunctionOnNextCall(g2);
+
+g1({ f : 1});
+g2({ f : 2});
+g1({});
+
+assertUnoptimized(g1);
+
+// Deoptimization of g1 should also deoptimize g2 because they should share
+// the optimized code object.  (Unfortunately, this test bakes in various
+// other assumptions about dealing with optimized code, and thus might break
+// in future.)
+assertUnoptimized(g2);
+
+g2({});