[turbofan] Use the ArgumentsAdaptorTrampoline in case of argument count mismatch.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/code-factory.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/node-matchers.h"
@@ skipping 1571 matching lines @@
   Node* frame_state = NodeProperties::GetFrameStateInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
   // Check if {target} is a known JSFunction.
   if (target_type->IsConstant() &&
       target_type->AsConstant()->Value()->IsJSFunction()) {
     Handle<JSFunction> function =
         Handle<JSFunction>::cast(target_type->AsConstant()->Value());
     Handle<SharedFunctionInfo> shared(function->shared(), isolate());
+
+    // Grab the context from the {function}.
+    Node* context = jsgraph()->Constant(handle(function->context(), isolate()));
+    NodeProperties::ReplaceContextInput(node, context);
+
+    // Check if we need to convert the {receiver}.
+    if (is_sloppy(shared->language_mode()) && !shared->native() &&
+        !receiver_type->Is(Type::Receiver())) {
+      receiver = effect =
+          graph()->NewNode(javascript()->ConvertReceiver(convert_mode),
+                           receiver, context, frame_state, effect, control);
+      NodeProperties::ReplaceEffectInput(node, effect);
+      NodeProperties::ReplaceValueInput(node, receiver, 1);
+    }
+
+    // Remove the eager bailout frame state.
+    NodeProperties::RemoveFrameStateInput(node, 1);
+
+    // Compute flags for the call.
+    CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
+    if (p.AllowTailCalls()) flags |= CallDescriptor::kSupportsTailCalls;
+
     if (shared->internal_formal_parameter_count() == arity) {
-      // Grab the context from the {function}.
-      Node* context =
-          jsgraph()->Constant(handle(function->context(), isolate()));
-      NodeProperties::ReplaceContextInput(node, context);
-
-      // Check if we need to convert the {receiver}.
-      if (is_sloppy(shared->language_mode()) && !shared->native() &&
-          !receiver_type->Is(Type::Receiver())) {
-        receiver = effect =
-            graph()->NewNode(javascript()->ConvertReceiver(convert_mode),
-                             receiver, context, frame_state, effect, control);
-        NodeProperties::ReplaceEffectInput(node, effect);
-        NodeProperties::ReplaceValueInput(node, receiver, 1);
-      }
-
-      // Remove the eager bailout frame state.
-      NodeProperties::RemoveFrameStateInput(node, 1);
-
       // Patch {node} to a direct call.
-      CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
-      if (p.AllowTailCalls()) flags |= CallDescriptor::kSupportsTailCalls;
       NodeProperties::ChangeOp(node,
                                common()->Call(Linkage::GetJSCallDescriptor(
                                    graph()->zone(), false, 1 + arity, flags)));
-      return Changed(node);
+    } else {
+      Callable callable = CodeFactory::ArgumentAdaptor(isolate());
+      node->InsertInput(graph()->zone(), 0,
+                        jsgraph()->HeapConstant(callable.code()));
+      node->InsertInput(graph()->zone(), 2, jsgraph()->Int32Constant(arity));
+      node->InsertInput(
+          graph()->zone(), 3,
+          jsgraph()->Int32Constant(shared->internal_formal_parameter_count()));
+      NodeProperties::ChangeOp(
+          node, common()->Call(Linkage::GetStubCallDescriptor(
+                    isolate(), graph()->zone(), callable.descriptor(),
+                    1 + arity, flags)));
     }
+    return Changed(node);
   }
 
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSForInDone(Node* node) {
   DCHECK_EQ(IrOpcode::kJSForInDone, node->opcode());
   node->TrimInputCount(2);
   NodeProperties::ChangeOp(node, machine()->Word32Equal());
@@ skipping 488 matching lines @@
 }
 
 
 MachineOperatorBuilder* JSTypedLowering::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8