[turbofan] Work around negative parameter count.

src/compiler/typer.cc

Index: src/compiler/typer.cc
diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc
index 94b9d6d1bb118461dddac3aebc72f0b74a48b9bf..891c711972c28c59bc1f6234d8cddcd5574c14ce 100644
--- a/src/compiler/typer.cc
+++ b/src/compiler/typer.cc
@@ -2410,6 +2410,10 @@ Type* Typer::Visitor::TypeConstant(Handle<Object> value) {
     int const arity =
         JSFunction::cast(*value)->shared()->internal_formal_parameter_count();
     switch (arity) {
+      case SharedFunctionInfo::kDontAdaptArgumentsSentinel:
+        // Some smart optimization at work... &%$!&@+$!
+        // https://code.google.com/p/chromium/issues/detail?id=500824

[Michael Starzinger, 2015/06/16 09:03:17]

nit: We probably don't need to reference the issue here.

[Benedikt Meurer, 2015/06/16 09:04:05]

Done.

+        return Type::Any(zone());
       case 0:
         return typer_->cache_->Get(kAnyFunc0);
       case 1:
@@ -2419,6 +2423,7 @@ Type* Typer::Visitor::TypeConstant(Handle<Object> value) {
       case 3:
         return typer_->cache_->Get(kAnyFunc3);
       default: {
+        DCHECK_LT(3, arity);
         Type** const params = zone()->NewArray<Type*>(arity);
         std::fill(&params[0], &params[arity], Type::Any(zone()));
         return Type::Function(Type::Any(zone()), arity, params, zone());