A JSFunction that is in the old space could move during a scavenge
between being marked and the ClearFlushedJSFunctions, therefore only add
candidates that are in the old generation.

BUG=v8:8755,v8:8395

Change-Id: I3850188e8a0f9f39de994e170b4cda4fe6961079
Reviewed-on: https://chromium-review.googlesource.com/c/1448277Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59281}