[turbofan] Fix wrong assumption in inlining

JSInliner class wrongly assumed that all functions passing through
JSInliningHeuristic have feedback vectors, but that's not the case
when the inlining candidate hasn't been called yet.

Bug: chromium:961522
Change-Id: I89c0f2098add19d9b59394f1e7230cbec426119d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1605720Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61400}

src/compiler/js-inlining.cc

@@ -285,7 +285,11 @@ base::Optional<SharedFunctionInfoRef> JSInliner::DetermineCallTarget(
   //  - JSConstruct(target:constant, args..., new.target)
   if (match.HasValue() && match.Ref(broker()).IsJSFunction()) {
     JSFunctionRef function = match.Ref(broker()).AsJSFunction();
-    CHECK(function.has_feedback_vector());
+
+    // The function might have not been called yet.
+    if (!function.has_feedback_vector()) {
+      return base::nullopt;
+    }
 
     // Disallow cross native-context inlining for now. This means that all parts
     // of the resulting code will operate on the same global object. This also
@@ -332,6 +336,7 @@ FeedbackVectorRef JSInliner::DetermineCallContext(Node* node,
 
   if (match.HasValue() && match.Ref(broker()).IsJSFunction()) {
     JSFunctionRef function = match.Ref(broker()).AsJSFunction();
+    // This was already ensured by DetermineCallTarget
     CHECK(function.has_feedback_vector());
 
     // The inlinee specializes to the context from the JSFunction object.

test/mjsunit/regress/regress-crbug-961522.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --nolazy
+
+(function () {
+  let arr = [, 3];
+  function inlined() {
+  }
+  function foo() {
+    arr.reduce(inlined);
+  }
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();