[crankshaft] Don't bailout on uninitialized access to arguments object.

When Crankshaft compiles a keyed load to arguments, it disabled
optimization unless the KEYED_LOAD_IC for the access was monomorphic.
But that's too restrictive, since it will also disable optimization
for this function when the access is on a path that was never executed
so far.

This was spotted in the Node.js core function EventEmitter.prototype.emit,
which was no longer optimizable with Crankshaft using latest V8.

R=jarin@chromium.org
BUG=v8:5790

Review-Url: https://codereview.chromium.org/2607303002
Cr-Commit-Position: refs/heads/master@{#42005}

src/crankshaft/hydrogen.cc

@@ -7399,7 +7399,7 @@ bool HOptimizedGraphBuilder::TryArgumentsAccess(Property* expr) {
   } else {
     // We need to take into account the KEYED_LOAD_IC feedback to guard the
     // HBoundsCheck instructions below.
-    if (!expr->IsMonomorphic()) return false;
+    if (!expr->IsMonomorphic() && !expr->IsUninitialized()) return false;
     if (IsAnyParameterContextAllocated()) return false;
     CHECK_ALIVE_OR_RETURN(VisitForValue(expr->obj(), ARGUMENTS_ALLOWED), true);
     CHECK_ALIVE_OR_RETURN(VisitForValue(expr->key()), true);

test/mjsunit/regress/regress-5790.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a) {
+  "use strict";
+  if (a) return arguments[1];
+}
+
+foo(false);
+foo(false);
+%OptimizeFunctionOnNextCall(foo);
+foo(true, 1);
+foo(true, 1);
+%OptimizeFunctionOnNextCall(foo);
+foo(false);
+foo(true, 1);
+assertOptimized(foo);