Fix f.apply() optimization when declared arguments are mutated.

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index e118a1174299f443bea166b1e266fd8c8665cb3e..bf920b564558fd93bfd97a08baddd04fa7bfceb7 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -8004,11 +8004,14 @@ bool HOptimizedGraphBuilder::TryCallApply(Call* expr) {
     // TODO(mstarzinger): For now we just ensure arguments are pushed
     // right after HEnterInlined, but we could be smarter about this.
     EnsureArgumentsArePushedForAccess();
-    HEnvironment* arguments_env = environment()->arguments_environment();
-    int parameter_count = arguments_env->parameter_count();
+    ASSERT_EQ(environment()->arguments_environment()->parameter_count(),
+              function_state()->entry()->arguments_values()->length());
+    HEnterInlined* entry = function_state()->entry();
+    ZoneList<HValue*>* arguments_values = entry->arguments_values();
+    int parameter_count = arguments_values->length();

[Toon Verwaest, 2013/02/14 14:58:20]

Please rename this to arguments_count, given that it's the number of
argument_values.

[Michael Starzinger, 2013/02/14 15:12:01]

Done.

     PushAndAdd(new(zone()) HWrapReceiver(receiver, function));
-    for (int i = 1; i < arguments_env->parameter_count(); i++) {
-      Push(arguments_env->Lookup(i));
+    for (int i = 1; i < parameter_count; i++) {
+      Push(arguments_values->at(i));
     }
 
     Handle<JSFunction> known_function;
@@ -8021,8 +8024,8 @@ bool HOptimizedGraphBuilder::TryCallApply(Call* expr) {
 
     Drop(parameter_count - 1);
     PushAndAdd(new(zone()) HPushArgument(Pop()));
-    for (int i = 1; i < arguments_env->parameter_count(); i++) {
-      PushAndAdd(new(zone()) HPushArgument(arguments_env->Lookup(i)));
+    for (int i = 1; i < parameter_count; i++) {
+      PushAndAdd(new(zone()) HPushArgument(arguments_values->at(i)));
     }
 
     HValue* context = environment()->LookupContext();