CallIC used an invalid mechanism to detect if it was in optimized code.

src/ic/ic.cc

Index: src/ic/ic.cc
diff --git a/src/ic/ic.cc b/src/ic/ic.cc
index a4dce6a66ac64952aaa5a4e9d398aba79a0392e5..f34c2fdfc346ddfb8841b74a784c90a5582aa2f6 100644
--- a/src/ic/ic.cc
+++ b/src/ic/ic.cc
@@ -224,13 +224,9 @@ Code* IC::GetOriginalCode() const {
 
 
 bool IC::AddressIsOptimizedCode() const {
-  Object* maybe_function =
-      Memory::Object_at(fp() + JavaScriptFrameConstants::kFunctionOffset);
-  if (maybe_function->IsJSFunction()) {
-    JSFunction* function = JSFunction::cast(maybe_function);
-    return function->IsOptimized();
-  }
-  return false;
+  Code* host =
+      isolate()->inner_pointer_to_code_cache()->GetCacheEntry(address())->code;
+  return host->kind() == Code::OPTIMIZED_FUNCTION;
 }