[turbofan] Fix reduction of LoadProperty/StoreProperty to LoadNamed/StoreNamed.

src/compiler/js-type-feedback.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-type-feedback.h"
 
 #include "src/property-details.h"
 
 #include "src/accessors.h"
 #include "src/ast.h"
 #include "src/type-info.h"
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/common-operator.h"
 #include "src/compiler/node-aux-data.h"
 #include "src/compiler/node-matchers.h"
+#include "src/compiler/operator-properties.h"
 #include "src/compiler/simplified-operator.h"
 
 namespace v8 {
 namespace internal {
 namespace compiler {
 
 enum LoadOrStore { LOAD, STORE };
 
 JSTypeFeedbackTable::JSTypeFeedbackTable(Zone* zone)
     : map_(TypeFeedbackIdMap::key_compare(),
            TypeFeedbackIdMap::allocator_type(zone)) {}
 
 
 void JSTypeFeedbackTable::Record(Node* node, TypeFeedbackId id) {
   map_.insert(std::make_pair(node->id(), id));
 }
 
 
 Reduction JSTypeFeedbackSpecializer::Reduce(Node* node) {
   switch (node->opcode()) {
     case IrOpcode::kJSLoadProperty: {
       HeapObjectMatcher<Name> match(node->InputAt(1));
       if (match.HasValue() && match.Value().handle()->IsName()) {
         // LoadProperty(o, "constant") => LoadNamed["constant"](o).
         Unique<Name> name = match.Value();
         const VectorSlotPair& feedback =
             LoadPropertyParametersOf(node->op()).feedback();
-        node->set_op(jsgraph()->javascript()->LoadNamed(name, feedback));
+        node->set_op(jsgraph()->javascript()->LoadNamed(name, feedback,
+                                                        NOT_CONTEXTUAL, KEYED));
         node->RemoveInput(1);
         return ReduceJSLoadNamed(node);
       }
       return ReduceJSLoadProperty(node);
     }
     case IrOpcode::kJSLoadNamed:
       return ReduceJSLoadNamed(node);
     case IrOpcode::kJSStoreNamed:
       return ReduceJSStoreNamed(node);
     case IrOpcode::kJSStoreProperty: {
       HeapObjectMatcher<Name> match(node->InputAt(1));
       if (match.HasValue() && match.Value().handle()->IsName()) {
         // StoreProperty(o, "constant", v) => StoreNamed["constant"](o, v).
         Unique<Name> name = match.Value();
         LanguageMode language_mode = OpParameter<LanguageMode>(node);
-        node->set_op(jsgraph()->javascript()->StoreNamed(language_mode, name));
+        if (FLAG_turbo_deoptimization) {
+          // StoreProperty has 2 frame state inputs, but StoreNamed only 1.
+          DCHECK_EQ(2, OperatorProperties::GetFrameStateInputCount(node->op()));
+          node->RemoveInput(NodeProperties::FirstFrameStateIndex(node) + 1);
+        }
+        node->set_op(
+            jsgraph()->javascript()->StoreNamed(language_mode, name, KEYED));
         node->RemoveInput(1);
         return ReduceJSStoreNamed(node);
       }
       return ReduceJSStoreProperty(node);
     }
     default:
       break;
   }
   return NoChange();
 }
@@ skipping 205 matching lines @@
   // TODO(turbofan): filter maps by initial receiver map if known
   // TODO(turbofan): filter maps by native context (if specializing)
   // TODO(turbofan): filter maps by effect chain
   oracle()->PropertyReceiverTypes(id, name, maps);
 }
 
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8