[TypeFeedbackVector] Root literal arrays in function literals slots

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 1263 matching lines @@
   if (nexus.IsUninitialized()) {
     return NoChange();
   }
 
   if (nexus.ic_state() == MEGAMORPHIC) {
     return NoChange();
   }
 
   DCHECK_EQ(MONOMORPHIC, nexus.ic_state());
 
-  Handle<Map> receiver_map(nexus.FindFirstMap(), isolate());
+  Map* map = nexus.FindFirstMap();
+  if (map == nullptr) {
+    // Maps are weakly held in the type feedback vector, we may not have one.
+    return NoChange();
+  }
+
+  Handle<Map> receiver_map(map, isolate());
   Handle<Name> cached_name =
       handle(Name::cast(nexus.GetFeedbackExtra()), isolate());
 
   PropertyAccessInfo access_info;
   AccessInfoFactory access_info_factory(dependencies(), native_context(),
                                         graph()->zone());
   if (!access_info_factory.ComputePropertyAccessInfo(
           receiver_map, cached_name, AccessMode::kStoreInLiteral,
           &access_info)) {
     return NoChange();
@@ skipping 611 matching lines @@
   return jsgraph()->javascript();
 }
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8