Remove obsolete 'arguments' local variable handling.

This removes special casing for the 'f.arguments' property accessor. Any
local 'arguments' variable should not be allowed to influence the value
returned by the indirect 'f.arguments' property. That property creates a
new object with a separate identity everytime it is read. This is by now
consistent with other browsers.

R=rossberg@chromium.org
TEST=mjsunit/arguments-indirect

Review URL: https://codereview.chromium.org/1408983006

Cr-Commit-Position: refs/heads/master@{#31776}

src/accessors.cc

@@ -1175,20 +1175,7 @@ Handle<Object> GetFunctionArguments(Isolate* isolate,
       return ArgumentsForInlinedFunction(frame, function, function_index);
     }
 
-    if (!frame->is_optimized()) {
-      // If there is an arguments variable in the stack, we return that.
-      Handle<ScopeInfo> scope_info(function->shared()->scope_info());
-      int index = scope_info->StackSlotIndex(
-          isolate->heap()->arguments_string());
-      if (index >= 0) {
-        Handle<Object> arguments(frame->GetExpression(index), isolate);
-        if (!arguments->IsArgumentsMarker()) return arguments;
-      }
-    }
-
-    // If there is no arguments variable in the stack or we have an
-    // optimized frame, we find the frame that holds the actual arguments
-    // passed to the function.
+    // Find the frame that holds the actual arguments passed to the function.
     it.AdvanceToArgumentsFrame();
     frame = it.frame();
 

test/mjsunit/arguments-indirect.js

@@ -35,8 +35,15 @@ function f2(x) {
   g(f2);
 }
 
+function f3(x) {
+  var a = arguments;
+  (function() { x++ })();
+  g(f3);
+}
 
 function g(f) {
+  assertEquals("object", typeof f.arguments);
+  assertFalse(f.arguments === f.arguments);
   assertEquals(3, f.arguments.length);
   assertEquals(1, f.arguments[0]);
   assertEquals(2, f.arguments[1]);
@@ -44,4 +51,5 @@ function g(f) {
 }
 
 f1(1,2,3);
-f2(0,2,3);
+f2(1,2,3);
+f3(1,2,3);

test/mjsunit/mjsunit.status

@@ -57,11 +57,6 @@
   ##############################################################################
   # TurboFan compiler failures.
 
-  # TODO(mstarzinger): An arguments object materialized in the prologue can't
-  # be accessed indirectly. Either we drop that requirement or wait for support
-  # from the deoptimizer to do that.
-  'arguments-indirect': [PASS, NO_VARIANTS],
-
   # TODO(verwaest): Some tests are over-restrictive about object layout.
   'array-constructor-feedback': [PASS, NO_VARIANTS],
   'array-feedback': [PASS, NO_VARIANTS],

test/mozilla/mozilla.status

@@ -55,7 +55,6 @@
 
   # TODO(turbofan): These are all covered by mjsunit as well. Enable them once
   # we pass 'mjsunit' and 'webkit' with TurboFan.
-  'js1_4/Functions/function-001': [PASS, NO_VARIANTS],
   'js1_5/Regress/regress-80981': [PASS, NO_VARIANTS],
 
   # TODO(turbofan): Causes timeouts since top-level code is optimized.
@@ -264,6 +263,10 @@
   # This section is for tests that fail in both V8 and JSC.  Thus they
   # have been determined to be incompatible between Mozilla and V8/JSC.
 
+  # Any local 'arguments' variable should not be allowed to shadow the value
+  # returned via the indirect 'arguments' property accessor.
+  'js1_4/Functions/function-001': [FAIL_OK],
+
   # toPrecision argument restricted to range 1..21 in JSC/V8 and ECMA-262
   'js1_5/Regress/regress-452346': [FAIL_OK],