Revert of [heap] Remove eager shortcut in JSFunction visitor. (patchset #1...

Revert of [heap] Remove eager shortcut in JSFunction visitor. (patchset #1 id:1 of https://codereview.chromium.org/1476223002/ )

Reason for revert:
Still investigating bad canary.

Original issue's description:
> [heap] Remove eager shortcut in JSFunction visitor.
>
> This removes an optimization in the static JSFunction visitor that
> eagerly marked through to the SharedFunctionInfo for code flushing
> candidates. This causes all processing in VisitJSFunction to be
> side-stepped and hence might cause leaks.
>
> R=hpayer@chromium.org
>
> Committed: https://crrev.com/a29f0576c32e8fda90bf7ab19c6d170568150a7f
> Cr-Commit-Position: refs/heads/master@{#32332}

TBR=mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1488063002

Cr-Commit-Position: refs/heads/master@{#32463}

src/heap/objects-visiting-inl.h

@@ -464,6 +464,14 @@ void StaticMarkingVisitor<StaticVisitor>::VisitJSFunction(Map* map,
       // non-flushable, because it is required for bailing out from
       // optimized code.
       collector->code_flusher()->AddCandidate(function);
+      // Visit shared function info immediately to avoid double checking
+      // of its flushability later. This is just an optimization because
+      // the shared function info would eventually be visited.
+      SharedFunctionInfo* shared = function->shared();
+      if (StaticVisitor::MarkObjectWithoutPush(heap, shared)) {
+        StaticVisitor::MarkObject(heap, shared->map());
+        VisitSharedFunctionInfoWeakCode(heap, shared);
+      }
       // Treat the reference to the code object weakly.
       VisitJSFunctionWeakCode(map, object);
       return;