Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/0ac7a48ae8c6dbfd1dd4c9e6d5cd4b1a8bd72fe1 ([foozzie] Add slow-path correctness fuzzing variants).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

Some turbofan/ignition error message difference. PTAL compiler folks.

// My minimized repro:
v = {};
v.__proto__ = String.prototype.split;
function foo(func, ...args) {
  try {
    func.apply(undefined, args);
  } catch (e) {
    return "!" + e;
  }
}

print(JSON.stringify(foo(v)));
%OptimizeFunctionOnNextCall(foo);
print(JSON.stringify(foo(v)));


// foozzie output:
# Compared x64,ignition with x64,ignition_turbo
#
# Flags of x64,ignition:
--abort_on_stack_or_string_length_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --es-staging --wasm-num-compilation-tasks=0 --suppress-asm-messages --random-seed 1743351996 --turbo-filter=~ --noopt --liftoff --no-wasm-tier-up
# Flags of x64,ignition_turbo:
--abort_on_stack_or_string_length_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --es-staging --wasm-num-compilation-tasks=0 --suppress-asm-messages --random-seed 1743351996
#
# Difference:
- "!TypeError: Function.prototype.apply was called on [object Object], which is a object and not a function"
+ "!TypeError: func.apply is not a function"
#
# Source file:
none
#
### Start of configuration x64,ignition:
"!TypeError: Function.prototype.apply was called on [object Object], which is a object and not a function"
"!TypeError: Function.prototype.apply was called on [object Object], which is a object and not a function"

### End of configuration x64,ignition
#
### Start of configuration x64,ignition_turbo:
"!TypeError: Function.prototype.apply was called on [object Object], which is a object and not a function"
"!TypeError: func.apply is not a function"

### End of configuration x64,ignition_turbo

TurboFan lowers this whole Function.prototype.apply() invocation to a CallWithArrayLike, which essentially boils down to an invocation of the CallFunction builtin. This produces the generic message "func.apply is not a function". The Function.prototype.apply builtin however produces a more sophisticated error message.

The fix here is to probably only do the TurboFan optimization if we know that the receiver is actually callable (which we can get from the preceeding LOAD_IC).

The same problem also affects the Function.prototype.call() inlining I guess.