[turbofan] Improve error reporting in call reducer

Bug: chromium:1034203
Change-Id: I225fa6416d443802b063e149da6e6fca0a176bb1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1969898
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65479}

src/compiler/js-call-reducer.cc

@@ -1554,10 +1554,15 @@ Reduction JSCallReducer::ReduceFunctionPrototypeBind(Node* node) {
         receiver_map.GetStrongValue(kLengthIndex));
     base::Optional<ObjectRef> name_value(
         receiver_map.GetStrongValue(kNameIndex));
+    if (!length_value || !name_value) {
+      TRACE_BROKER_MISSING(
+          broker(), "name or length descriptors on map " << receiver_map);
+      return inference.NoChange();
+    }
     if (!receiver_map.GetPropertyKey(kLengthIndex).equals(length_string) ||
-        (length_value && !length_value->IsAccessorInfo()) ||
+        !length_value->IsAccessorInfo() ||
         !receiver_map.GetPropertyKey(kNameIndex).equals(name_string) ||
-        (name_value && !name_value->IsAccessorInfo())) {
+        !name_value->IsAccessorInfo()) {
       return inference.NoChange();
     }
   }

test/mjsunit/compiler/regress-1034203.js → test/mjsunit/regress/regress-crbug-1034203.js

@@ -2,20 +2,17 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --opt --allow-natives-syntax
+// Flags: --allow-natives-syntax
 
 function foo(optimized) {
   class C {
-    ['h']() { return 42; }
+    ['h']() {}
   }
   let h = C.prototype.h;
-  let val = h.bind()();
-  if (optimized) {
-    %TurbofanStaticAssert(val === 42);
-  }
+  h.bind();
 }
 
 %PrepareFunctionForOptimization(foo);
-foo(false);
+foo();
 %OptimizeFunctionOnNextCall(foo);
-foo(true);
+foo();