Move of the type feedback vector to the closure.

src/compiler/js-inlining.cc

Index: src/compiler/js-inlining.cc
diff --git a/src/compiler/js-inlining.cc b/src/compiler/js-inlining.cc
index 53ff3c9c1da9d3730e77fd1fe7caff34fc93990c..cc7b83847a33081bdce3fc302b6c270fb00e94d7 100644
--- a/src/compiler/js-inlining.cc
+++ b/src/compiler/js-inlining.cc
@@ -435,6 +435,7 @@ Reduction JSInliner::ReduceJSCall(Node* node, Handle<JSFunction> function) {
           info_->shared_info()->DebugName()->ToCString().get());
     return NoChange();
   }
+
   // Remember that we inlined this function. This needs to be called right
   // after we ensure deoptimization support so that the code flusher
   // does not remove the code with the deoptimization support.
@@ -448,6 +449,9 @@ Reduction JSInliner::ReduceJSCall(Node* node, Handle<JSFunction> function) {
         shared_info->DebugName()->ToCString().get(),
         info_->shared_info()->DebugName()->ToCString().get());
 
+  // If function was lazily compiled, it's literals array may not yet be set up.
+  JSFunction::EnsureLiterals(function);
+
   // Run the loop assignment analyzer on the inlinee.
   AstLoopAssignmentAnalyzer loop_assignment_analyzer(&zone, &info);
   LoopAssignmentAnalysis* loop_assignment = loop_assignment_analyzer.Analyze();