Treat HArgumentsObject as a safe use during Uint32 analysis phase.

test/mjsunit/compiler/uint32.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 153 matching lines @@
   for (var i = 0; i < N; i++) {
     old_array[i] = uint32_array[1];
   }
 }
 
 FillOldArrayWithHeapNumbers(1);
 FillOldArrayWithHeapNumbers(1);
 %OptimizeFunctionOnNextCall(FillOldArrayWithHeapNumbers);
 FillOldArrayWithHeapNumbers(old_array.length);
 gc();
+
+// Test that HArgumentsObject does not prevent uint32 optimization and
+// that arguments object with uint32 values inside is correctly materialized.
+function Pack(x, y) {
+  try {  // Prevent inlining.
+    return [x, y];
+  } catch (e) {
+  }
+}
+
+function InnerWithArguments(x, f) {
+  "use strict";
+  x >>>= 8;
+  return f(arguments[0], x|0);
+}
+
+function Outer(v, f) {
+  return InnerWithArguments(v >>> 0, f);
+}
+
+assertArrayEquals([0x0100, 0x01], Outer(0x0100, Pack));
+assertArrayEquals([0x0100, 0x01], Outer(0x0100, Pack));
+assertArrayEquals([0x0100, 0x01], Outer(0x0100, Pack));
+%OptimizeFunctionOnNextCall(Outer);
+assertArrayEquals([0x0100, 0x01], Outer(0x0100, Pack));
+assertArrayEquals([0xFFFFFFFF, 0x00FFFFFF], Outer(-1, Pack));
+
+// Cause deopt inside InnerWithArguments by passing different pack function.
+assertArrayEquals([0xFFFFFFFF, 0x00FFFFFF], Outer(-1, function (x, y) {
+  return [x, y];
+}));