[Heap] Only reset JSFunctions that have been flushed in the old space

A JSFunction that is in the old space could move during a scavenge
between being marked and the ClearFlushedJSFunctions, therefore only add
candidates that are in the old generation.

BUG=v8:8755,v8:8395

Change-Id: I3850188e8a0f9f39de994e170b4cda4fe6961079
Reviewed-on: https://chromium-review.googlesource.com/c/1448277Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59281}

src/heap/incremental-marking.cc

@@ -670,6 +670,18 @@ void IncrementalMarking::UpdateWeakReferencesAfterScavenge() {
   weak_objects_->current_ephemerons.Update(ephemeron_updater);
   weak_objects_->next_ephemerons.Update(ephemeron_updater);
   weak_objects_->discovered_ephemerons.Update(ephemeron_updater);
+
+  weak_objects_->flushed_js_functions.Update(
+      [](JSFunction slot_in, JSFunction* slot_out) -> bool {
+        JSFunction forwarded = ForwardingAddress(slot_in);
+
+        if (!forwarded.is_null()) {
+          *slot_out = forwarded;
+          return true;
+        }
+
+        return false;
+      });
 #ifdef DEBUG
   weak_objects_->bytecode_flushing_candidates.Iterate(
       [](SharedFunctionInfo candidate) {