Fix bug in inlining Function.apply.

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 5b9e42f9979195104780f8c89e5cb5ca061b8932..be41de57e68751e32feef978eaf8fec12b6d2c70 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -7560,6 +7560,13 @@ bool HOptimizedGraphBuilder::TryCallApply(Call* expr) {
   // Found pattern f.apply(receiver, arguments).
   CHECK_ALIVE_OR_RETURN(VisitForValue(prop->obj()), true);
   HValue* function = Top();
+  // The function get here may be an undefined constant if lookup fails.
+  if (function->IsConstant() &&
+      !HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
+    Drop(1);
+    return false;

[Michael Starzinger, 2013/11/28 16:01:25]

I don't think it is safe to bail out at this point, this will cause prop->obj()
to be visited twice. That might be an arbitrary complex expression (maybe with
side-effects). IMHO, the correct fix is further down ...

+  }
+
   AddCheckConstantFunction(expr->holder(), function, function_map);
   Drop(1);