Flush ICache on startup deserialization after marking memory executable

Tentative fix for Android invoke crashers with write protection code
enabled.

Bug: chromium:842862
Change-Id: If238b25b239b50c597f3745aa683f564a717434f
Reviewed-on: https://chromium-review.googlesource.com/1061513Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53209}

src/isolate.cc

@@ -3082,6 +3082,10 @@ bool Isolate::Init(StartupDeserializer* des) {
 
     heap_.NotifyDeserializationComplete();
   }
+  // Flush the instruction cache for the entire code-space. Must happen after
+  // builtins deserialization and setting the memory executable again.
+  if (!create_heap_objects) des->FlushICacheForNewIsolate();
+
   delete setup_delegate_;
   setup_delegate_ = nullptr;
 

src/snapshot/startup-deserializer.cc

@@ -45,10 +45,6 @@ void StartupDeserializer::DeserializeInto(Isolate* isolate) {
     // Deserialize eager builtins from the builtin snapshot. Note that deferred
     // objects must have been deserialized prior to this.
     builtin_deserializer.DeserializeEagerBuiltinsAndHandlers();
-
-    // Flush the instruction cache for the entire code-space. Must happen after
-    // builtins deserialization.
-    FlushICacheForNewIsolate();
   }
 
   isolate->heap()->set_native_contexts_list(isolate->heap()->undefined_value());

src/snapshot/startup-deserializer.h

@@ -21,8 +21,9 @@ class StartupDeserializer final : public Deserializer<> {
   // Deserialize the snapshot into an empty heap.
   void DeserializeInto(Isolate* isolate);
 
- private:
   void FlushICacheForNewIsolate();
+
+ private:
   void PrintDisassembledCodeObjects();
 
   // Rehash after deserializing an isolate.