Fix bug in inlining Function.apply.

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 5b9e42f9979195104780f8c89e5cb5ca061b8932..ba84ac39200bd69d080bb7a61a0d2ae5029f3033 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -7560,6 +7560,12 @@ bool HOptimizedGraphBuilder::TryCallApply(Call* expr) {
   // Found pattern f.apply(receiver, arguments).
   CHECK_ALIVE_OR_RETURN(VisitForValue(prop->obj()), true);
   HValue* function = Top();
+  // The function get here may be an undefined constant if lookup fails.
+  if (function->IsConstant() &&
+      !HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
+    return false;

[Jakob Kummerow, 2013/11/28 15:17:30]

I think we need to Drop(1) before returning.

+  }
+
   AddCheckConstantFunction(expr->holder(), function, function_map);
   Drop(1);