[turbofan] Avoid going through ArgumentsAdaptorTrampoline for CSA/C++ builtins.

When we call from TurboFan to a CSA or C++ builtin, we can avoid the
ArgumentsAdaptorFrame in case of a parameter arity mismatch by just
filling up missing arguments with undefined or removing additional
arguments on the call site already. This is safe for CSA/C++ builtins,
since those that care about variable arguments are marked with the
kDontAdaptArgumentsSentinel.

R=danno@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2684963002
Cr-Commit-Position: refs/heads/master@{#44218}

src/compiler/js-call-reducer.cc

@@ -520,11 +520,44 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
         return Changed(node);
       }
 
+      // For CSA/C++ builtin {target}s, we can ensure that the number
+      // of parameters we pass to the {target} matches exactly the
+      // number of formal parameters expected by the builtin, and thus
+      // avoid creating an ArgumentsAdaptorFrame. This is safe because
+      // all CSA/C++ builtins that care about variable arguments are
+      // declared with the kDontAdaptArgumentsSentinel marker.
+      int builtin_index = shared->code()->builtin_index();
+      if (builtin_index != -1 && shared->native() && !shared->IsInterpreted()) {
+        // Check if we have an arguments mismatch for {target}.
+        int arity = static_cast<int>(p.arity() - 2);
+        int num_parameters = shared->internal_formal_parameter_count();
+        if (num_parameters != arity &&
+            num_parameters != SharedFunctionInfo::kDontAdaptArgumentsSentinel) {
+          // Fill up missing parameters with undefined.
+          while (arity < num_parameters) {
+            node->InsertInput(graph()->zone(), arity + 2,
+                              jsgraph()->UndefinedConstant());
+            arity++;
+          }
+          // Remove additional parameters.
+          while (arity > num_parameters) {
+            node->RemoveInput(arity + 1);
+            arity--;
+          }
+          NodeProperties::ChangeOp(
+              node, javascript()->Call(arity + 2, p.frequency(), p.feedback(),
+                                       p.convert_mode(), p.tail_call_mode()));
+          // Try to further reduce the JSCall {node}.
+          Reduction const reduction = ReduceJSCall(node);
+          return reduction.Changed() ? reduction : Changed(node);
+        }
+      }
+
       // Don't inline cross native context.
       if (function->native_context() != *native_context()) return NoChange();
 
       // Check for known builtin functions.
-      switch (shared->code()->builtin_index()) {
+      switch (builtin_index) {
         case Builtins::kFunctionPrototypeApply:
           return ReduceFunctionPrototypeApply(node);
         case Builtins::kFunctionPrototypeCall: