Skip non-compilation functions in %OptimizeOsr

Bug: chromium:1258603
Change-Id: Ife2284de6151c7e70592b55871875061b93bbcca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3218193Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77405}

src/runtime/runtime-test.cc

@@ -494,6 +494,10 @@ RUNTIME_FUNCTION(Runtime_OptimizeOsr) {
 
   if (!FLAG_opt) return ReadOnlyRoots(isolate).undefined_value();
 
+  if (!function->shared().allows_lazy_compilation()) {
+    return CrashUnlessFuzzing(isolate);
+  }
+
   if (function->shared().optimization_disabled() &&
       function->shared().disable_optimization_reason() ==
           BailoutReason::kNeverOptimize) {

test/mjsunit/regress/regress-crbug-1258603.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --fuzzing --no-testing-d8-test-runner
+
+[1,2,3].reduceRight(() => { %OptimizeOsr(1); });