[turbofan] Create initial map on-demand for F.prototype.

src/compiler/js-native-context-specialization.cc

Index: src/compiler/js-native-context-specialization.cc
diff --git a/src/compiler/js-native-context-specialization.cc b/src/compiler/js-native-context-specialization.cc
index 094e3a1166c79e3fee86883a97e42a53eef057e7..ea6120dd6b0f7ecce0a2611dde22da554106f3ab 100644
--- a/src/compiler/js-native-context-specialization.cc
+++ b/src/compiler/js-native-context-specialization.cc
@@ -826,18 +826,16 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadNamed(Node* node) {
         p.name().is_identical_to(factory()->prototype_string())) {
       // Optimize "prototype" property of functions.
       Handle<JSFunction> function = Handle<JSFunction>::cast(m.Value());
-      if (function->has_initial_map()) {
-        // We need to add a code dependency on the initial map of the
-        // {function} in order to be notified about changes to the
-        // "prototype" of {function}, so it doesn't make sense to
-        // continue unless deoptimization is enabled.
-        Handle<Map> initial_map(function->initial_map(), isolate());
-        dependencies()->AssumeInitialMapCantChange(initial_map);
-        Handle<Object> prototype(function->prototype(), isolate());
-        Node* value = jsgraph()->Constant(prototype);
-        ReplaceWithValue(node, value);
-        return Replace(value);
-      }
+      // We need to add a code dependency on the initial map of the
+      // {function} in order to be notified about changes to the
+      // "prototype" of {function}.
+      JSFunction::EnsureHasInitialMap(function);

[Michael Starzinger, 2017/04/19 10:38:58]

The function must be constructible. The following is a repro ...

function f() {
  print(parseInt.prototype);
}
f();
f();
%OptimizeFunctionOnNextCall(f);
f();

+      Handle<Map> initial_map(function->initial_map(), isolate());
+      dependencies()->AssumeInitialMapCantChange(initial_map);
+      Handle<Object> prototype(function->prototype(), isolate());
+      Node* value = jsgraph()->Constant(prototype);
+      ReplaceWithValue(node, value);
+      return Replace(value);
     } else if (m.Value()->IsString() &&
                p.name().is_identical_to(factory()->length_string())) {
       // Constant-fold "length" property on constant strings.