Fix materialization of arguments objects with unknown values.

test/mjsunit/regress/regress-crbug-163530.js

Index: test/mjsunit/regress/regress-crbug-163530.js
diff --git a/test/mjsunit/compiler/property-static.js b/test/mjsunit/regress/regress-crbug-163530.js
similarity index 57%
copy from test/mjsunit/compiler/property-static.js
copy to test/mjsunit/regress/regress-crbug-163530.js
index 07021340cd7aa94440638f925eeed921ee78c9c7..7abae14a8be81bc8756b8fb20ba6badbc78ef3cd 100644
--- a/test/mjsunit/compiler/property-static.js
+++ b/test/mjsunit/regress/regress-crbug-163530.js
@@ -27,43 +27,54 @@
 
 // Flags: --allow-natives-syntax
 
-// Test usage of static type information for loads that would otherwise
-// turn into polymorphic or generic loads.
+// Test materialization of an arguments object with unknown argument
+// values in non-strict mode (length has to be zero).
+(function() {
+  var deoptimize = { deopt:true };
+  var object = {};
 
-// Prepare a highly polymorphic load to be used by all tests.
-Object.prototype.load = function() { return this.property; };
-Object.prototype.load.call({ A:0, property:10 });
-Object.prototype.load.call({ A:0, B:0, property:11 });
-Object.prototype.load.call({ A:0, B:0, C:0, property:12 });
-Object.prototype.load.call({ A:0, B:0, C:0, D:0, property:13 });
-Object.prototype.load.call({ A:0, B:0, C:0, D:0, E:0, property:14 });
-Object.prototype.load.call({ A:0, B:0, C:0, D:0, E:0, F:0, property:15 });
+  object.a = function A(x, y, z) {
+    assertSame(0, arguments.length);
+    return this.b();
+  };
 
-// Test for object literals.
-(function() {
-  function f(x) {
-    var object = { property:x };
-    return object.load();
-  }
+  object.b = function B() {
+    assertSame(0, arguments.length);
+    deoptimize.deopt;
+    return arguments.length;
+  };
 
-  assertSame(1, f(1));
-  assertSame(2, f(2));
-  %OptimizeFunctionOnNextCall(f);
-  assertSame(3, f(3));
+  assertSame(0, object.a());
+  assertSame(0, object.a());
+  %OptimizeFunctionOnNextCall(object.a);
+  assertSame(0, object.a());
+  delete deoptimize.deopt;
+  assertSame(0, object.a());
 })();
 
-// Test for inlined constructors.
+
+// Test materialization of an arguments object with unknown argument
+// values in strict mode (length is allowed to exceed stack size).
 (function() {
-  function c(x) {
-    this.property = x;
-  }
-  function f(x) {
-    var object = new c(x);
-    return object.load();
-  }
+  'use strict';
+  var deoptimize = { deopt:true };
+  var object = {};
+
+  object.a = function A(x, y, z) {
+    assertSame(0, arguments.length);
+    return this.b(1, 2, 3, 4, 5, 6, 7, 8);
+  };
+
+  object.b = function B(a, b, c, d, e, f, g, h) {
+    assertSame(8, arguments.length);
+    deoptimize.deopt;
+    return arguments.length;
+  };
 
-  assertSame(1, f(1));
-  assertSame(2, f(2));
-  %OptimizeFunctionOnNextCall(f);
-  assertSame(3, f(3));
+  assertSame(8, object.a());
+  assertSame(8, object.a());
+  %OptimizeFunctionOnNextCall(object.a);
+  assertSame(8, object.a());
+  delete deoptimize.deopt;
+  assertSame(8, object.a());
 })();