[turbofan] Fail slack tracking dependency if initial map disappears.

Bug: chromium:890057
Change-Id: I98bc278ebc202c3d8f6417367bd1c592e4824011
Reviewed-on: https://chromium-review.googlesource.com/1250481
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56279}

src/compiler/compilation-dependencies.cc

@@ -271,6 +271,7 @@ class InitialMapInstanceSizePredictionDependency final
   bool IsValid() const override {
     // The dependency is valid if the prediction is the same as the current
     // slack tracking result.
+    if (!function_.object<JSFunction>()->has_initial_map()) return false;
     int instance_size =
         function_.object<JSFunction>()->ComputeInstanceSizeWithMinSlack(
             function_.isolate());

test/mjsunit/compiler/regress-890057.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {}
+function g() {
+  f.prototype = undefined;
+  f();
+  new f();
+}
+
+// Do not use %OptimizeFunctionOnNextCall here, this particular bug needs
+// to trigger truly concurrent compilation.
+for (let i = 0; i < 10000; i++) g();