ClearTypeFeedbackInfo(): context may not be initialized.

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "v8.h"
 
 #include "accessors.h"
 #include "allocation-site-scopes.h"
 #include "api.h"
 #include "arguments.h"
@@ skipping 11227 matching lines @@
                   info->host()->constant_pool());
       }
     }
   }
 }
 
 
 void SharedFunctionInfo::ClearTypeFeedbackInfo() {
   FixedArray* vector = feedback_vector();
   Heap* heap = GetHeap();
+  JSFunction* array_function = NULL;
+
+  // Clearing type feedback can be called when the contexts are still being
+  // set up so caution is required.
   Context* context = GetIsolate()->context();
-  JSFunction* array_function = context != NULL
-      ? context->native_context()->array_function()
-      : NULL;
+  if (context != NULL) {
+    Context* native_context = context->native_context();
+    Object* candidate = native_context->get(Context::ARRAY_FUNCTION_INDEX);
+    if (candidate->IsJSFunction()) {
+      array_function = JSFunction::cast(candidate);
+    }
+  }
+
   int length = vector->length();
 
   for (int i = 0; i < length; i++) {
     Object* obj = vector->get(i);
     if (obj->IsHeapObject()) {
       InstanceType instance_type =
           HeapObject::cast(obj)->map()->instance_type();
       switch (instance_type) {
         case ALLOCATION_SITE_TYPE:
           // AllocationSites are not cleared because they do not store
@@ skipping 6048 matching lines @@
 #define ERROR_MESSAGES_TEXTS(C, T) T,
   static const char* error_messages_[] = {
       ERROR_MESSAGES_LIST(ERROR_MESSAGES_TEXTS)
   };
 #undef ERROR_MESSAGES_TEXTS
   return error_messages_[reason];
 }
 
 
 } }  // namespace v8::internal