Fix bug in inlining Function.apply.

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 7542 matching lines @@
   if (args->length() != 2) return false;
 
   VariableProxy* arg_two = args->at(1)->AsVariableProxy();
   if (arg_two == NULL || !arg_two->var()->IsStackAllocated()) return false;
   HValue* arg_two_value = LookupAndMakeLive(arg_two->var());
   if (!arg_two_value->CheckFlag(HValue::kIsArguments)) return false;
 
   // Found pattern f.apply(receiver, arguments).
   CHECK_ALIVE_OR_RETURN(VisitForValue(prop->obj()), true);
   HValue* function = Top();
+  // The function get here may be an undefined constant if lookup fails.
+  if (function->IsConstant() &&
+      !HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
+    Drop(1);
+    return false;

[Michael Starzinger, 2013/11/28 16:01:25]

I don't think it is safe to bail out at this point, this will cause prop->obj()
to be visited twice. That might be an arbitrary complex expression (maybe with
side-effects). IMHO, the correct fix is further down ...

+  }
+
   AddCheckConstantFunction(expr->holder(), function, function_map);
   Drop(1);
 
   CHECK_ALIVE_OR_RETURN(VisitForValue(args->at(0)), true);
   HValue* receiver = Pop();
 
   if (function_state()->outer() == NULL) {
     HInstruction* elements = Add<HArgumentsElements>(false);
     HInstruction* length = Add<HArgumentsLength>(elements);
     HValue* wrapped_receiver = BuildWrapReceiver(receiver, function);
@@ skipping 10 matching lines @@
               function_state()->entry()->arguments_object()->arguments_count());
     HArgumentsObject* args = function_state()->entry()->arguments_object();
     const ZoneList<HValue*>* arguments_values = args->arguments_values();
     int arguments_count = arguments_values->length();
     Push(BuildWrapReceiver(receiver, function));
     for (int i = 1; i < arguments_count; i++) {
       Push(arguments_values->at(i));
     }
 
     Handle<JSFunction> known_function;
     if (function->IsConstant()) {

[Michael Starzinger, 2013/11/28 16:01:25]

... here, because that is the only place where the constant function is actually
inspected unsafely.

       HConstant* constant_function = HConstant::cast(function);
       known_function = Handle<JSFunction>::cast(
           constant_function->handle(isolate()));
       int args_count = arguments_count - 1;  // Excluding receiver.
       if (TryInlineApply(known_function, expr, args_count)) return true;
     }
 
     Drop(arguments_count - 1);
     Push(Add<HPushArgument>(Pop()));
     for (int i = 1; i < arguments_count; i++) {
@@ skipping 3210 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal