[turbofan] Fix deoptimization from array literal spread.

This fixes the array literal expression stack tracking in the presence
of spread expressions. Deoptimization within a spread expression was
borked.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-deopt-in-array-literal-spread

Review URL: https://codereview.chromium.org/1455953002

Cr-Commit-Position: refs/heads/master@{#32079}

src/compiler/ast-graph-builder.cc

@@ -1951,7 +1951,6 @@ void AstGraphBuilder::VisitArrayLiteral(ArrayLiteral* expr) {
   environment()->Pop();  // Array literal index.
   for (; array_index < expr->values()->length(); array_index++) {
     Expression* subexpr = expr->values()->at(array_index);
-    Node* array = environment()->Pop();
     Node* result;
 
     if (subexpr->IsSpread()) {
@@ -1959,6 +1958,7 @@ void AstGraphBuilder::VisitArrayLiteral(ArrayLiteral* expr) {
       FrameStateBeforeAndAfter states(this,
                                       subexpr->AsSpread()->expression()->id());
       Node* iterable = environment()->Pop();
+      Node* array = environment()->Pop();
       Node* function = BuildLoadNativeContextField(
           Context::CONCAT_ITERABLE_TO_ARRAY_BUILTIN_INDEX);
       result = NewNode(javascript()->CallFunction(3, language_mode()), function,
@@ -1967,6 +1967,7 @@ void AstGraphBuilder::VisitArrayLiteral(ArrayLiteral* expr) {
     } else {
       VisitForValue(subexpr);
       Node* value = environment()->Pop();
+      Node* array = environment()->Pop();
       const Operator* op =
           javascript()->CallRuntime(Runtime::kAppendElement, 2);
       result = NewNode(op, array, value);

test/mjsunit/mjsunit.status

@@ -994,6 +994,7 @@
   'regress/regress-crbug-546968': [SKIP],
   'regress/regress-deopt-gcb': [SKIP],
   'regress/regress-deopt-gc': [SKIP],
+  'regress/regress-deopt-in-array-literal-spread': [SKIP],
   'regress/regress-embedded-cons-string': [SKIP],
   'regress/regress-existing-shared-function-info': [SKIP],
   'regress/regress-fast-literal-transition': [SKIP],

test/mjsunit/regress/regress-deopt-in-array-literal-spread.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a,b,c,d) { return [a, ...(%DeoptimizeNow(), [b,c]), d]; }
+
+assertEquals([1,2,3,4], f(1,2,3,4));
+assertEquals([1,2,3,4], f(1,2,3,4));
+%OptimizeFunctionOnNextCall(f);
+assertEquals([1,2,3,4], f(1,2,3,4));

test/mjsunit/regress/regress-osr-in-literal.js

@@ -17,6 +17,7 @@ var testCases = [
   { s:"{ [do { _OSR_ 'b' }]: 3 }",                   r:{ b:3 } },
   { s:"{ [do { _OSR_ 'b' }]: 3, c: 4 }",             r:{ b:3, c:4 } },
   { s:"{ [do { _OSR_ 'b' }]: 3, __proto__:p }",      r:{ b:3, __proto__:p } },
+  { s:"{ get [do { _OSR_ 'c' }]() { return 4; } }",  r:{ c:4 } },
   { s:"class { [do { _OSR_ 'f' }]() {} }" },
   { s:"class { [do { _OSR_ 'f' }]() {}; g() {} }" },
 ];