[turbofan] Don't try to optimize tail calls to .apply.

BUG=chromium:685634
R=ishell@chromium.org

Review-Url: https://codereview.chromium.org/2658853002
Cr-Commit-Position: refs/heads/master@{#42713}

src/compiler/js-call-reducer.cc

@@ -79,6 +79,10 @@ Reduction JSCallReducer::ReduceFunctionPrototypeApply(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCallFunction, node->opcode());
   Node* target = NodeProperties::GetValueInput(node, 0);
   CallFunctionParameters const& p = CallFunctionParametersOf(node->op());
+  // Tail calls to Function.prototype.apply are not properly supported
+  // down the pipeline, so we disable this optimization completely for
+  // tail calls (for now).
+  if (p.tail_call_mode() == TailCallMode::kAllow) return NoChange();
   Handle<JSFunction> apply =
       Handle<JSFunction>::cast(HeapObjectMatcher(target).Value());
   size_t arity = p.arity();

test/mjsunit/regress/regress-crbug-685634.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-tailcalls
+
+"use strict";
+
+function foo(f) { return f.apply(this, arguments); }
+function bar() {}
+
+foo(bar);
+%OptimizeFunctionOnNextCall(foo);
+foo(bar);