[turbofan] fix wrong materialization of arguments object

R=jarin@chromium.org

BUG=

Review-Url: https://codereview.chromium.org/2664423003
Cr-Commit-Position: refs/heads/master@{#42916}

src/compiler/js-call-reducer.cc

@@ -117,16 +117,18 @@ Reduction JSCallReducer::ReduceFunctionPrototypeApply(Node* node) {
     CreateArgumentsType const type = CreateArgumentsTypeOf(arg_array->op());
     Node* frame_state = NodeProperties::GetFrameStateInput(arg_array);
     FrameStateInfo state_info = OpParameter<FrameStateInfo>(frame_state);
+    int formal_parameter_count;
     int start_index = 0;
-    if (type == CreateArgumentsType::kMappedArguments) {
-      // Mapped arguments (sloppy mode) cannot be handled if they are aliased.
+    {
       Handle<SharedFunctionInfo> shared;
       if (!state_info.shared_info().ToHandle(&shared)) return NoChange();
-      if (shared->internal_formal_parameter_count() != 0) return NoChange();
+      formal_parameter_count = shared->internal_formal_parameter_count();
+    }
+    if (type == CreateArgumentsType::kMappedArguments) {
+      // Mapped arguments (sloppy mode) cannot be handled if they are aliased.
+      if (formal_parameter_count != 0) return NoChange();
     } else if (type == CreateArgumentsType::kRestParameter) {
-      Handle<SharedFunctionInfo> shared;
-      if (!state_info.shared_info().ToHandle(&shared)) return NoChange();
-      start_index = shared->internal_formal_parameter_count();
+      start_index = formal_parameter_count;
     }
     // Check if are applying to inlined arguments or to the arguments of
     // the outermost function.
@@ -135,7 +137,10 @@ Reduction JSCallReducer::ReduceFunctionPrototypeApply(Node* node) {
       // TODO(jarin,bmeurer): Support the NewUnmappedArgumentsElement and
       // NewRestParameterElements in the EscapeAnalysis and Deoptimizer
       // instead, then we don't need this hack.
-      if (type != CreateArgumentsType::kRestParameter) {
+      // Only works with zero formal parameters because of lacking deoptimizer
+      // support.
+      if (type != CreateArgumentsType::kRestParameter &&
+          formal_parameter_count == 0) {
         // There are no other uses of the {arg_array} except in StateValues,
         // so we just replace {arg_array} with a marker for the Deoptimizer
         // that this refers to the arguments object.

test/mjsunit/arguments-deopt.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo
+
+(function MaterializeStrictArguments() {
+  "use strict"
+
+  function f(x, y) {
+    return x + y;
+  }
+
+  function test() {
+    %DeoptimizeNow();
+    return f.apply(null, arguments);
+  }
+
+  assertEquals(test(1, 2), 3);
+  assertEquals(test(1, 2, 3), 3);
+
+  %OptimizeFunctionOnNextCall(test);
+  assertEquals(test(1, 2), 3);
+  %OptimizeFunctionOnNextCall(test);
+  assertEquals(test(1, 2, 3), 3);
+})();
+
+(function MaterializeSloppyArguments() {
+  function f(x, y) {
+    return x + y;
+  }
+
+  function test() {
+    %DeoptimizeNow();
+    return f.apply(null, arguments);
+  }
+
+  assertEquals(test(1, 2), 3);
+  assertEquals(test(1, 2, 3), 3);
+
+  %OptimizeFunctionOnNextCall(test);
+  assertEquals(test(1, 2), 3);
+  %OptimizeFunctionOnNextCall(test);
+  assertEquals(test(1, 2, 3), 3);
+})();
+
+(function MaterializeStrictOverwrittenArguments() {
+  "use strict"
+
+  function f(x, y) {
+    return x + y;
+  }
+
+  function test(a, b) {
+    a = 4;
+    %DeoptimizeNow();
+    return f.apply(null, arguments);
+  }
+
+  assertEquals(test(1, 2), 3);
+  assertEquals(test(1, 2, 3), 3);
+
+  %OptimizeFunctionOnNextCall(test);
+  assertEquals(test(1, 2), 3);
+  %OptimizeFunctionOnNextCall(test);
+  assertEquals(test(1, 2, 3), 3);
+})();
+
+(function MaterializeSloppyOverwrittenArguments() {
+  function f(x, y) {
+    return x + y;
+  }
+
+  function test(a, b) {
+    a = 4;
+    %DeoptimizeNow();
+    return f.apply(null, arguments);
+  }
+
+  test(1, 2);
+  test(3, 4, 5);
+
+  assertEquals(test(1, 2), 6);
+  assertEquals(test(1, 2, 3), 6);
+
+  %OptimizeFunctionOnNextCall(test);
+  assertEquals(test(1, 2), 6);
+  %OptimizeFunctionOnNextCall(test);
+  assertEquals(test(1, 2, 3), 6);
+})();