[turbofan] Skip byteLength optimization if we cannot install dependencies

Bug: v8:11111, chromium:1376784
Change-Id: I1e1e7ab3cc2eebc87410ad1e9f8785cff67a08a3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4008263
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84101}

src/compiler/js-call-reducer.cc

@@ -7867,7 +7867,9 @@ Reduction JSCallReducer::ReduceArrayBufferViewAccessor(
                    return IsRabGsabTypedArrayElementsKind(map.elements_kind());
                  }));
 
-  CHECK(inference.RelyOnMapsViaStability(dependencies()));
+  if (!inference.RelyOnMapsViaStability(dependencies())) {
+    return inference.NoChange();
+  }
 
   const bool depended_on_detaching_protector =
       dependencies()->DependOnArrayBufferDetachingProtector();

test/mjsunit/regress/regress-1376784.js

@@ -0,0 +1,32 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbofan
+
+function test() {
+  let depth = 100;
+  const arr = [];
+  const factory = class MyArray extends Uint8Array {
+    constructor() {
+      async function foo() { new factory(); }
+      if(depth-- > 0) {
+        const x = foo();
+        super(arr);
+        this.__proto__ = x;
+        const unused1 = super.byteLength;
+      } else {
+        super(arr);
+      }
+    }
+  };
+  const unused2 = new factory();
+  arr.__proto__ = factory;
+  return arr;
+}
+
+test();
+%PrepareFunctionForOptimization(test);
+test();
+%OptimizeFunctionOnNextCall(test);
+test();