[deoptimizer] Support off-heap code in deoptimizer

The deoptimizer can create argument adaptor frames, in which case we
write a return address onto the stack that jumps into the middle of
the ArgumentsAdaptorTrampoline builtin. Now that this builtin is
off-heap, we need to calculate the return address based on the
off-heap instruction stream, not the on-heap trampoline.

Bug: v8:6666
Change-Id: I55b27fe8b0573f6c6ae66375850352f71bdff618
Reviewed-on: https://chromium-review.googlesource.com/934202
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51520}

src/deoptimizer.cc

@@ -13,6 +13,7 @@
 #include "src/disasm.h"
 #include "src/frames-inl.h"
 #include "src/global-handles.h"
+#include "src/instruction-stream.h"
 #include "src/interpreter/interpreter.h"
 #include "src/macro-assembler.h"
 #include "src/objects/debug-objects-inl.h"
@@ -1116,8 +1117,17 @@ void Deoptimizer::DoComputeArgumentsAdaptorFrame(
   Builtins* builtins = isolate_->builtins();
   Code* adaptor_trampoline =
       builtins->builtin(Builtins::kArgumentsAdaptorTrampoline);
+  Address adaptor_trampoline_entry = adaptor_trampoline->instruction_start();
+#ifdef V8_EMBEDDED_BUILTINS
+  if (FLAG_stress_off_heap_code) {
+    DCHECK(Builtins::IsOffHeapSafe(Builtins::kArgumentsAdaptorTrampoline));
+    InstructionStream* stream = InstructionStream::TryLookupInstructionStream(
+        isolate(), adaptor_trampoline);
+    adaptor_trampoline_entry = stream->bytes();
+  }
+#endif  // V8_EMBEDDED_BUILTINS
   intptr_t pc_value = reinterpret_cast<intptr_t>(
-      adaptor_trampoline->instruction_start() +
+      adaptor_trampoline_entry +
       isolate_->heap()->arguments_adaptor_deopt_pc_offset()->value());
   output_frame->SetPc(pc_value);
   if (FLAG_enable_embedded_constant_pool) {