Fix typeof optimization for undetectable

test/mjsunit/regress/regress-5972.js

Index: test/mjsunit/regress/regress-5972.js
diff --git a/test/mjsunit/regress/regress-5972.js b/test/mjsunit/regress/regress-5972.js
new file mode 100644
index 0000000000000000000000000000000000000000..68fe3ac7209fd3433ca163aadffb22a0933003f7
--- /dev/null
+++ b/test/mjsunit/regress/regress-5972.js
@@ -0,0 +1,17 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var undetectable = %GetUndetectable();
+
+function foo(a) {
+  const o = a ? foo : undetectable;
+  return typeof o === 'function';
+}
+
+assertFalse(foo(false));

[vabr (Chromium), 2017/02/15 23:36:41]

Just out of curiosity: why is the call to foo() repeated twice before
instructing the compiler to optimize it?

[Benedikt Meurer, 2017/02/16 04:01:19]

This is kind of a habit. In this particular case we wouldn't need any warmup at
all actually. But in general if you have property accesses like o.x for example,
then the IC associated with it first transitions to a premonomorphic state
before going monomorphic. So you only get consumable feedback after the second
run in baseline.

+assertFalse(foo(false));
+%OptimizeFunctionOnNextCall(foo);
+assertFalse(foo(false));