[turbofan] Work around negative parameter count.

BUG=chromium:500824
LOG=n
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1186333002

Cr-Commit-Position: refs/heads/master@{#29043}

src/compiler/typer.cc

@@ -2410,6 +2410,9 @@ Type* Typer::Visitor::TypeConstant(Handle<Object> value) {
     int const arity =
         JSFunction::cast(*value)->shared()->internal_formal_parameter_count();
     switch (arity) {
+      case SharedFunctionInfo::kDontAdaptArgumentsSentinel:
+        // Some smart optimization at work... &%$!&@+$!
+        return Type::Any(zone());
       case 0:
         return typer_->cache_->Get(kAnyFunc0);
       case 1:
@@ -2419,6 +2422,7 @@ Type* Typer::Visitor::TypeConstant(Handle<Object> value) {
       case 3:
         return typer_->cache_->Get(kAnyFunc3);
       default: {
+        DCHECK_LT(3, arity);
         Type** const params = zone()->NewArray<Type*>(arity);
         std::fill(&params[0], &params[arity], Type::Any(zone()));
         return Type::Function(Type::Any(zone()), arity, params, zone());

test/mjsunit/regress/regress-crbug-500824.js

@@ -0,0 +1,23 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function get_thrower() {
+  "use strict";
+  return Object.getOwnPropertyDescriptor(arguments, "callee").get;
+}
+
+var f = (function(v) {
+  "use asm";
+  function fun() {
+    switch (v) {}
+  }
+  return {
+    fun: fun
+  };
+})(get_thrower()).fun;
+
+%OptimizeFunctionOnNextCall(f);
+f();