OptimizeFunctionOnNextCall and DeoptimizeFunction ignore calls on non-JSFunction objects.

src/runtime/runtime-test.cc

Index: src/runtime/runtime-test.cc
diff --git a/src/runtime/runtime-test.cc b/src/runtime/runtime-test.cc
index 5117e42679b652045a299c43af26cce562793988..ab0cdcec6cb045c2503ba0393e099fdeb4fd87be 100644
--- a/src/runtime/runtime-test.cc
+++ b/src/runtime/runtime-test.cc
@@ -16,7 +16,16 @@ namespace internal {
 RUNTIME_FUNCTION(Runtime_DeoptimizeFunction) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 1);
-  CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
+
+  // This function is used by clusterFuzz to get coverage in compiler.

[Michael Starzinger, 2016/04/15 13:51:35]

nit: Can we instead of mentioning "ClusterFuzz" specifically just talk about
"fuzzers" in general instead within this comment? This would not tie this
comment in V8's codebase to a specific fuzzer platform that we happen to be
using at the moment.

[mythria, 2016/04/15 14:10:06]

Thanks, Done.

+  // Ignore calls on non-function objects to avoid runtime errors.
+  CONVERT_ARG_HANDLE_CHECKED(Object, function_object, 0);
+  // If it is not a JSFunction, just return.
+  if (!function_object->IsJSFunction()) {
+    return isolate->heap()->undefined_value();
+  }
+  Handle<JSFunction> function = Handle<JSFunction>::cast(function_object);
+
   if (!function->IsOptimized()) return isolate->heap()->undefined_value();
 
   // TODO(turbofan): Deoptimization is not supported yet.
@@ -84,7 +93,16 @@ RUNTIME_FUNCTION(Runtime_IsConcurrentRecompilationSupported) {
 RUNTIME_FUNCTION(Runtime_OptimizeFunctionOnNextCall) {
   HandleScope scope(isolate);
   RUNTIME_ASSERT(args.length() == 1 || args.length() == 2);
-  CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
+
+  // This function is used by clusterFuzz to get coverage for optimizations

[Michael Starzinger, 2016/04/15 13:51:35]

nit: Likewise.

[mythria, 2016/04/15 14:10:06]

Done.

+  // in compiler. Ignore calls on non-function objects to avoid runtime errors.
+  CONVERT_ARG_HANDLE_CHECKED(Object, function_object, 0);
+  // If it is not a JSFunction, just return.
+  if (!function_object->IsJSFunction()) {
+    return isolate->heap()->undefined_value();
+  }
+  Handle<JSFunction> function = Handle<JSFunction>::cast(function_object);
+
   // The following assertion was lifted from the DCHECK inside
   // JSFunction::MarkForOptimization().
   RUNTIME_ASSERT(function->shared()->allows_lazy_compilation() ||