Harden OptimizeFunctionOnNextCall.

BUG=411237
LOG=N
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/547553003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23743 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/runtime.cc

@@ -8632,7 +8632,14 @@ RUNTIME_FUNCTION(Runtime_OptimizeFunctionOnNextCall) {
   HandleScope scope(isolate);
   RUNTIME_ASSERT(args.length() == 1 || args.length() == 2);
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
-
+  // The following two assertions are lifted from the DCHECKs inside
+  // JSFunction::MarkForOptimization().
+  RUNTIME_ASSERT(!function->shared()->is_generator());
+  RUNTIME_ASSERT(function->shared()->allows_lazy_compilation() ||
+                 (function->code()->kind() == Code::FUNCTION &&
+                  function->code()->optimizable()));
+
+  // If the function is optimized, just return.
   if (function->IsOptimized()) return isolate->heap()->undefined_value();
 
   function->MarkForOptimization();

test/mjsunit/regress/regress-411237.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony
+
+try {
+  %OptimizeFunctionOnNextCall(print);
+} catch(e) { }
+
+try {
+  function* f() {
+  }
+  %OptimizeFunctionOnNextCall(f);
+} catch(e) { }