[type-profile] Handle returns correctly.

src/runtime/runtime-object.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/bootstrapper.h"
 #include "src/debug/debug.h"
 #include "src/isolate-inl.h"
@@ skipping 679 matching lines @@
             .IsJust());
   return *object;
 }
 
 RUNTIME_FUNCTION(Runtime_CollectTypeProfile) {
   HandleScope scope(isolate);
   DCHECK_EQ(4, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Smi, position, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, value, 1);
   CONVERT_ARG_HANDLE_CHECKED(FeedbackVector, vector, 2);
   CONVERT_SMI_ARG_CHECKED(index, 3);

[Yang, 2017/03/22 09:43:06]

Do I understand correctly that this index is actually constant now, since we
only have a single type profile slot per feedback vector?

 
   DCHECK(FLAG_type_profile);
 
   Handle<Name> type = Object::TypeOf(isolate, value);
   if (value->IsJSReceiver()) {
     Handle<JSReceiver> object = Handle<JSReceiver>::cast(value);
     type = JSReceiver::GetConstructorName(object);
   }
 
+  DCHECK(!vector->ToSlot(index).IsInvalid());
   CollectTypeProfileNexus nexus(vector, vector->ToSlot(index));
   nexus.Collect(type, position->value());
 
   return isolate->heap()->undefined_value();
 }
 
 // Return property without being observable by accessors or interceptors.
 RUNTIME_FUNCTION(Runtime_GetDataProperty) {
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());
@@ skipping 297 matching lines @@
   if (!success) return isolate->heap()->exception();
   MAYBE_RETURN(
       JSReceiver::CreateDataProperty(&it, value, Object::THROW_ON_ERROR),
       isolate->heap()->exception());
   return *value;
 }
 
 
 }  // namespace internal
 }  // namespace v8