Move of the type feedback vector to the closure.

src/compiler/js-inlining.cc

Index: src/compiler/js-inlining.cc
diff --git a/src/compiler/js-inlining.cc b/src/compiler/js-inlining.cc
index 5c01ff32528d260f9b002e0be98630a65cc3befd..d682b40c5300ec0bd6d3079fc6f6df7f864311e0 100644
--- a/src/compiler/js-inlining.cc
+++ b/src/compiler/js-inlining.cc
@@ -433,6 +433,7 @@ Reduction JSInliner::ReduceJSCall(Node* node, Handle<JSFunction> function) {
           info_->shared_info()->DebugName()->ToCString().get());
     return NoChange();
   }
+
   // Remember that we inlined this function. This needs to be called right
   // after we ensure deoptimization support so that the code flusher
   // does not remove the code with the deoptimization support.
@@ -446,6 +447,9 @@ Reduction JSInliner::ReduceJSCall(Node* node, Handle<JSFunction> function) {
         shared_info->DebugName()->ToCString().get(),
         info_->shared_info()->DebugName()->ToCString().get());
 
+  // If function was lazily compiled, it's literals array may not yet be set up.
+  JSFunction::EnsureLiterals(function);
+
   // TODO(mstarzinger): We could use the temporary zone for the graph because
   // nodes are copied. This however leads to Zone-Types being allocated in the
   // wrong zone and makes the engine explode at high speeds. Explosion bad!