[turbofan] Create initial map on-demand for F.prototype.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 808 matching lines @@
   Node* const receiver = NodeProperties::GetValueInput(node, 0);
   Node* const value = jsgraph()->Dead();
 
   // Check if we have a constant receiver.
   HeapObjectMatcher m(receiver);
   if (m.HasValue()) {
     if (m.Value()->IsJSFunction() &&
         p.name().is_identical_to(factory()->prototype_string())) {
       // Optimize "prototype" property of functions.
       Handle<JSFunction> function = Handle<JSFunction>::cast(m.Value());
-      if (function->has_initial_map()) {
-        // We need to add a code dependency on the initial map of the
-        // {function} in order to be notified about changes to the
-        // "prototype" of {function}, so it doesn't make sense to
-        // continue unless deoptimization is enabled.
-        Handle<Map> initial_map(function->initial_map(), isolate());
-        dependencies()->AssumeInitialMapCantChange(initial_map);
-        Handle<Object> prototype(function->prototype(), isolate());
-        Node* value = jsgraph()->Constant(prototype);
-        ReplaceWithValue(node, value);
-        return Replace(value);
-      }
+      // We need to add a code dependency on the initial map of the
+      // {function} in order to be notified about changes to the
+      // "prototype" of {function}.
+      JSFunction::EnsureHasInitialMap(function);

[Michael Starzinger, 2017/04/19 10:38:58]

The function must be constructible. The following is a repro ...

function f() {
  print(parseInt.prototype);
}
f();
f();
%OptimizeFunctionOnNextCall(f);
f();

+      Handle<Map> initial_map(function->initial_map(), isolate());
+      dependencies()->AssumeInitialMapCantChange(initial_map);
+      Handle<Object> prototype(function->prototype(), isolate());
+      Node* value = jsgraph()->Constant(prototype);
+      ReplaceWithValue(node, value);
+      return Replace(value);
     } else if (m.Value()->IsString() &&
                p.name().is_identical_to(factory()->length_string())) {
       // Constant-fold "length" property on constant strings.
       Handle<String> string = Handle<String>::cast(m.Value());
       Node* value = jsgraph()->Constant(string->length());
       ReplaceWithValue(node, value);
       return Replace(value);
     }
   }
 
@@ skipping 1499 matching lines @@
   return jsgraph()->javascript();
 }
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8