[turbofan] Fix ReduceNamedAccess for detached global proxies

[turbofan] Fix ReduceNamedAccess for detached global proxies

There is no guarantee that Map::GetConstructor() returns a JSFunction.
Specifically, detached global proxies return the |null| sentinel. So
we have to check the object type before casting to JSFunction.

BUG=chromium:694141
Review-Url: https://codereview.chromium.org/2739303003
Cr-Commit-Position: refs/heads/master@{#43727}
Committed: https://chromium.googlesource.com/v8/v8/+/e61add91c1bccc02b101f21267ce9728d662d250

[Jakob Kummerow, 2017-03-10 14:48:50]

jkummerow@chromium.org changed reviewers:
+ bmeurer@chromium.org

[Jakob Kummerow, 2017-03-10 14:48:50]

PTAL.

I have no repro (and no proof that this fixes the bug), but from looking at
minidumps I know for sure that we're doing a JSFunction::cast(null).
Crankshaft's HOptimizedGraphBuilder::BuildNamedAccess performs the same
IsJSFunction() check.

[Benedikt Meurer, 2017-03-10 18:02:51]

Ah, good catch. That looks promising! LGTM

[Jakob Kummerow, 2017-03-10 18:12:23]

The CQ bit was checked by jkummerow@chromium.org

[commit-bot: I haz the power, 2017-03-10 18:12:27]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-10 18:33:36]

CQ is committing da patch.

Bot data: {"patchset_id": 1, "attempt_start_ts": 1489169543422100, "parent_rev":
"12ffd366fcfbc6c10b8e9cb13dd72328ef3adec0", "commit_rev":
"e61add91c1bccc02b101f21267ce9728d662d250"}

[commit-bot: I haz the power, 2017-03-10 18:33:42]

Description was changed from

==========
[turbofan] Fix ReduceNamedAccess for detached global proxies

There is no guarantee that Map::GetConstructor() returns a JSFunction.
Specifically, detached global proxies return the |null| sentinel. So
we have to check the object type before casting to JSFunction.

BUG=chromium:694141
==========

to

==========
[turbofan] Fix ReduceNamedAccess for detached global proxies

There is no guarantee that Map::GetConstructor() returns a JSFunction.
Specifically, detached global proxies return the |null| sentinel. So
we have to check the object type before casting to JSFunction.

BUG=chromium:694141

Review-Url: https://codereview.chromium.org/2739303003
Cr-Commit-Position: refs/heads/master@{#43727}
Committed:
https://chromium.googlesource.com/v8/v8/+/e61add91c1bccc02b101f21267ce9728d66...
==========

[commit-bot: I haz the power, 2017-03-10 18:33:43]

Committed patchset #1 (id:1) as
https://chromium.googlesource.com/v8/v8/+/e61add91c1bccc02b101f21267ce9728d66...