Fix f.apply() optimization when declared arguments are mutated.

test/mjsunit/compiler/inline-function-apply.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 30 matching lines @@
       var r = "A";
       if (argumentsCount == 1) r += B(10);
       if (argumentsCount == 2) r += B(10, 11);
       if (argumentsCount == 3) r += B(10, 11, 12);
       assertSame(1, x);
       assertSame(2, y);
       return r;
     }
 
     function B(x,y) {
-      // TODO(2539): Enable the mutation below once bug is fixed.
-      //x = 0; y = 0;
+      x = 0; y = 0;
       var r = "B" + dispatcher.func.apply(this, arguments);
       assertSame(argumentsCount, arguments.length);
       for (var i = 0; i < arguments.length; i++) {
         assertSame(10 + i, arguments[i]);
       }
       return r;
     }
 
     function C(x,y) {
       x = 0; y = 0;
@@ skipping 18 matching lines @@
     %DeoptimizeFunction(B);
     %ClearFunctionTypeFeedback(B);
     %DeoptimizeFunction(C);
     %ClearFunctionTypeFeedback(C);
   }
 
   for (var a = 1; a <= 3; a++) {
     test(a);
   }
 })();