[builtins] add context input to users of CreateKeyValueArray opcode

BUG=666622, v8:5388
R=bmeurer@chromium.org, mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2515683002
Cr-Commit-Position: refs/heads/master@{#41118}

src/compiler/js-builtin-reducer.cc

@@ -444,8 +444,9 @@ Reduction JSBuiltinReducer::ReduceFastArrayIteratorNext(
 
         if (kind == IterationKind::kEntries) {
           // Allocate elements for key/value pair
-          vtrue1 = etrue1 = graph()->NewNode(
-              javascript()->CreateKeyValueArray(), index, value, etrue1);
+          vtrue1 = etrue1 =
+              graph()->NewNode(javascript()->CreateKeyValueArray(), index,
+                               value, context, etrue1);
         } else {
           DCHECK_EQ(kind, IterationKind::kValues);
           vtrue1 = value;
@@ -620,8 +621,9 @@ Reduction JSBuiltinReducer::ReduceTypedArrayIteratorNext(
 
         if (kind == IterationKind::kEntries) {
           // Allocate elements for key/value pair
-          vtrue2 = etrue2 = graph()->NewNode(
-              javascript()->CreateKeyValueArray(), index, value, etrue2);
+          vtrue2 = etrue2 =
+              graph()->NewNode(javascript()->CreateKeyValueArray(), index,
+                               value, context, etrue2);
         } else {
           DCHECK(kind == IterationKind::kValues);
           vtrue2 = value;

test/mjsunit/es6/regress/regress-666622.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function iterateArray() {
+  var array = new Array();
+  var it = array.entries();
+  it.next();
+}
+
+function iterateTypedArray() {
+  var array = new Uint8Array();
+  var it = array.entries();
+  it.next();
+}
+
+function testArray() {
+  iterateArray();
+  try {
+  } catch (e) {
+  }
+}
+testArray();
+testArray();
+%OptimizeFunctionOnNextCall(testArray);
+testArray();
+
+function testTypedArray() {
+  iterateTypedArray();
+  try {
+  } catch (e) {
+  }
+}
+testTypedArray();
+testTypedArray();
+%OptimizeFunctionOnNextCall(testTypedArray);
+testTypedArray();