[hydrogen] Add crash-hunting instrumentation to Hydrogen too

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/hydrogen.h"
 
 #include <sstream>
 
 #include "src/allocation-site-scopes.h"
 #include "src/ast-numbering.h"
@@ skipping 9602 matching lines @@
   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
   Expression* callee = expr->expression();
   int argument_count = expr->arguments()->length() + 1;  // Plus receiver.
   HInstruction* call = NULL;
 
   Property* prop = callee->AsProperty();
   if (prop != NULL) {
     CHECK_ALIVE(VisitForValue(prop->obj()));
     HValue* receiver = Top();
 
+    // Sanity check: The receiver must be a JS-exposed kind of object,
+    // not something internal (like a Map, or FixedArray). Check this here
+    // to chase after a rare but recurring crash bug. It seems to always
+    // occur for functions beginning with "this.foo.bar()", so be selective
+    // and only insert the check for the first call (identified by slot).
+    // TODO(chromium:527994): Remove this when we have a few crash reports.
+    if (prop->key()->IsPropertyName() &&
+        prop->PropertyFeedbackSlot().ToInt() == 2) {
+      IfBuilder if_heapobject(this);
+      if_heapobject.IfNot<HIsSmiAndBranch>(receiver);
+      if_heapobject.Then();
+      {
+        IfBuilder special_map(this);
+        Factory* factory = isolate()->factory();
+        special_map.If<HCompareMap>(receiver, factory->fixed_array_map());
+        special_map.OrIf<HCompareMap>(receiver, factory->meta_map());
+        special_map.Then();
+        Add<HDebugBreak>();
+        special_map.End();
+      }
+      if_heapobject.End();
+    }
+
     SmallMapList* maps;
     ComputeReceiverTypes(expr, receiver, &maps, zone());
 
     if (prop->key()->IsPropertyName() && maps->length() > 0) {
       Handle<String> name = prop->key()->AsLiteral()->AsPropertyName();
       PropertyAccessInfo info(this, LOAD, maps->first(), name);
       if (!info.CanAccessAsMonomorphic(maps)) {
         HandlePolymorphicCallNamed(expr, receiver, maps, name);
         return;
       }
@@ skipping 3901 matching lines @@
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 }  // namespace internal
 }  // namespace v8