[turbofan] Shortcut TFJ builtin calls.

Lowers JS calls to direct code object calls for known TFJ builtins.

Bug: v8:7794
Change-Id: I68984eeeff799cae4b87e6ae6720228e90340200
Reviewed-on: https://chromium-review.googlesource.com/1078287Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53440}

src/compiler/js-typed-lowering.cc

@@ -1706,6 +1706,21 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
       // Patch {node} to a direct CEntry call.
       ReduceBuiltin(isolate(), jsgraph(), node, shared->builtin_id(), arity,
                     flags);
+    } else if (shared->HasBuiltinId() &&
+               Builtins::KindOf(shared->builtin_id()) == Builtins::TFJ) {
+      // Patch {node} to a direct code object call.
+      Callable callable = Builtins::CallableFor(
+          isolate(), static_cast<Builtins::Name>(shared->builtin_id()));
+      CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
+
+      const CallInterfaceDescriptor& descriptor = callable.descriptor();
+      auto call_descriptor = Linkage::GetStubCallDescriptor(
+          isolate(), graph()->zone(), descriptor, 1 + arity, flags);
+      Node* stub_code = jsgraph()->HeapConstant(callable.code());
+      node->InsertInput(graph()->zone(), 0, stub_code);  // Code object.
+      node->InsertInput(graph()->zone(), 2, new_target);
+      node->InsertInput(graph()->zone(), 3, argument_count);
+      NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
     } else {
       // Patch {node} to a direct call.
       node->InsertInput(graph()->zone(), arity + 2, new_target);