Type Feedback Vector lives in the closure

src/compiler/js-inlining.cc

Index: src/compiler/js-inlining.cc
diff --git a/src/compiler/js-inlining.cc b/src/compiler/js-inlining.cc
index 99a1547b9acafb817fc4f37b53917ac4bba072d6..d9a1c9e1459d1a18aa86d1dcf51e457c74eca534 100644
--- a/src/compiler/js-inlining.cc
+++ b/src/compiler/js-inlining.cc
@@ -410,6 +410,9 @@ Reduction JSInliner::ReduceJSCall(Node* node, Handle<JSFunction> function) {
   // does not remove the code with the deoptimization support.
   info_->AddInlinedFunction(info.shared_info());
 
+  // If function was lazily compiled, it's literals array may not yet be set up.
+  JSFunction::EnsureLiterals(function);
+
   // ----------------------------------------------------------------
   // After this point, we've made a decision to inline this function.
   // We shall not bailout from inlining if we got here.