[compiler] JSCallReducer: check uses based on index

Bug: chromium:1355824
Change-Id: Ic0809f68259939086ad0e9a329b718eaf0e107aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3869266
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82922}

src/compiler/js-call-reducer.cc

@@ -4118,25 +4118,25 @@ JSCallReducer::ReduceCallOrConstructWithArrayLikeOrSpreadOfCreateArguments(
       case IrOpcode::kJSCallWithArrayLike: {
         // Ignore uses as argumentsList input to calls with array like.
         JSCallWithArrayLikeNode n(user);
-        if (n.Argument(0) == arguments_list) continue;
+        if (edge.index() == n.ArgumentIndex(0)) continue;
         break;
       }
       case IrOpcode::kJSConstructWithArrayLike: {
         // Ignore uses as argumentsList input to calls with array like.
         JSConstructWithArrayLikeNode n(user);
-        if (n.Argument(0) == arguments_list) continue;
+        if (edge.index() == n.ArgumentIndex(0)) continue;
         break;
       }
       case IrOpcode::kJSCallWithSpread: {
         // Ignore uses as spread input to calls with spread.
         JSCallWithSpreadNode n(user);
-        if (n.LastArgument() == arguments_list) continue;
+        if (edge.index() == n.LastArgumentIndex()) continue;
         break;
       }
       case IrOpcode::kJSConstructWithSpread: {
         // Ignore uses as spread input to construct with spread.
         JSConstructWithSpreadNode n(user);
-        if (n.LastArgument() == arguments_list) continue;
+        if (edge.index() == n.LastArgumentIndex()) continue;
         break;
       }
       default:

test/mjsunit/compiler/regress-crbug-1355824.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(...v) {
+  function bar() {
+    return arguments.length;
+  }
+  Array.prototype.splice.apply(v, v);
+  Array.prototype.splice.apply(v, v);
+  return bar(...v);
+}
+%PrepareFunctionForOptimization(foo);
+assertEquals(3, foo(1, 2, 3, 4));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(3, foo(1, 2, 3, 4));
+assertEquals(3, foo(1, 2, 3, 4));