[turbofan] Add appropriate types to express Callable.

src/api-natives.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/api-natives.h"
 
 #include "src/api.h"
 #include "src/isolate-inl.h"
 #include "src/lookup.h"
 #include "src/messages.h"
@@ skipping 638 matching lines @@
       type = JS_OBJECT_TYPE;  // Keep the compiler happy.
       break;
   }
 
   Handle<Map> map =
       isolate->factory()->NewMap(type, instance_size, FAST_HOLEY_SMI_ELEMENTS);
   JSFunction::SetInitialMap(result, map, Handle<JSObject>::cast(prototype));
 
   // Mark as undetectable if needed.
   if (obj->undetectable()) {
+    // We only allow callable undetectable receivers here, since this whole
+    // undetectable business is only to support document.all, which is both
+    // undetectable and callable. If we ever see the need to have an object
+    // that is undetectable but not callable, we need to update the types.h
+    // to allow encoding this.
+    CHECK(!obj->instance_call_handler()->IsUndefined(isolate));
     map->set_is_undetectable();
   }
 
   // Mark as needs_access_check if needed.
   if (obj->needs_access_check()) {
     map->set_is_access_check_needed(true);
   }
 
   // Set interceptor information in the map.
   if (!obj->named_property_handler()->IsUndefined(isolate)) {
     map->set_has_named_interceptor();
   }
   if (!obj->indexed_property_handler()->IsUndefined(isolate)) {
     map->set_has_indexed_interceptor();
   }
 
   // Mark instance as callable in the map.
   if (!obj->instance_call_handler()->IsUndefined(isolate)) {
     map->set_is_callable();
     map->set_is_constructor(true);
   }
 
   if (immutable_proto) map->set_immutable_proto(true);
 
   return result;
 }
 
 }  // namespace internal
 }  // namespace v8