[turbofan] Fix various issues with --turbo-inlining enabled.

src/compiler/js-inlining-heuristic.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-inlining-heuristic.h"
 
 #include "src/compiler/dead-code-elimination.h"  // TODO(mstarzinger): Remove!
 #include "src/compiler/node-matchers.h"
 #include "src/objects-inl.h"
 
@@ skipping 38 matching lines @@
     return NoChange();
   }
 
   // Quick check on the size of the AST to avoid parsing large candidate.
   if (function->shared()->ast_node_count() > FLAG_max_inlined_nodes) {
     return NoChange();
   }
 
   // Gather feedback on how often this call site has been hit before.
   CallFunctionParameters p = CallFunctionParametersOf(node->op());
-  CallICNexus nexus(p.feedback().vector(), p.feedback().slot());
-  int calls = nexus.ExtractCallCount();
+  int calls = -1;  // Same default as CallICNexus::ExtractCallCount.
+  if (p.feedback().IsValid()) {
+    CallICNexus nexus(p.feedback().vector(), p.feedback().slot());
+    calls = nexus.ExtractCallCount();
+  }
 
   // ---------------------------------------------------------------------------
   // Everything above this line is part of the inlining heuristic.
   // ---------------------------------------------------------------------------
 
   // In the general case we remember the candidate for later.
   candidates_.push_back({function, node, calls});
   return NoChange();
 }
 
@@ skipping 34 matching lines @@
            candidate.node->id(), candidate.calls,
            candidate.function->shared()->SourceSize(),
            candidate.function->shared()->ast_node_count(),
            candidate.function->shared()->DebugName()->ToCString().get());
   }
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8