[turbofan] Use the ArgumentsAdaptorTrampoline in case of argument count mismatch.

src/compiler/js-typed-lowering.cc

Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index 0f612e1d5f666eb1ade72b9b219ecbf1ac5cff55..a37f818761d6c4cc97dd0207af3e5a47862c8c7e 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -1589,33 +1589,47 @@ Reduction JSTypedLowering::ReduceJSCallFunction(Node* node) {
     Handle<JSFunction> function =
         Handle<JSFunction>::cast(target_type->AsConstant()->Value());
     Handle<SharedFunctionInfo> shared(function->shared(), isolate());
-    if (shared->internal_formal_parameter_count() == arity) {
-      // Grab the context from the {function}.
-      Node* context =
-          jsgraph()->Constant(handle(function->context(), isolate()));
-      NodeProperties::ReplaceContextInput(node, context);
-
-      // Check if we need to convert the {receiver}.
-      if (is_sloppy(shared->language_mode()) && !shared->native() &&
-          !receiver_type->Is(Type::Receiver())) {
-        receiver = effect =
-            graph()->NewNode(javascript()->ConvertReceiver(convert_mode),
-                             receiver, context, frame_state, effect, control);
-        NodeProperties::ReplaceEffectInput(node, effect);
-        NodeProperties::ReplaceValueInput(node, receiver, 1);
-      }
 
-      // Remove the eager bailout frame state.
-      NodeProperties::RemoveFrameStateInput(node, 1);
+    // Grab the context from the {function}.
+    Node* context = jsgraph()->Constant(handle(function->context(), isolate()));
+    NodeProperties::ReplaceContextInput(node, context);
+
+    // Check if we need to convert the {receiver}.
+    if (is_sloppy(shared->language_mode()) && !shared->native() &&
+        !receiver_type->Is(Type::Receiver())) {
+      receiver = effect =
+          graph()->NewNode(javascript()->ConvertReceiver(convert_mode),
+                           receiver, context, frame_state, effect, control);
+      NodeProperties::ReplaceEffectInput(node, effect);
+      NodeProperties::ReplaceValueInput(node, receiver, 1);
+    }
+
+    // Remove the eager bailout frame state.
+    NodeProperties::RemoveFrameStateInput(node, 1);
+
+    // Compute flags for the call.
+    CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
+    if (p.AllowTailCalls()) flags |= CallDescriptor::kSupportsTailCalls;
 
+    if (shared->internal_formal_parameter_count() == arity) {
       // Patch {node} to a direct call.
-      CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
-      if (p.AllowTailCalls()) flags |= CallDescriptor::kSupportsTailCalls;
       NodeProperties::ChangeOp(node,
                                common()->Call(Linkage::GetJSCallDescriptor(
                                    graph()->zone(), false, 1 + arity, flags)));
-      return Changed(node);
+    } else {
+      Callable callable = CodeFactory::ArgumentAdaptor(isolate());
+      node->InsertInput(graph()->zone(), 0,
+                        jsgraph()->HeapConstant(callable.code()));
+      node->InsertInput(graph()->zone(), 2, jsgraph()->Int32Constant(arity));
+      node->InsertInput(
+          graph()->zone(), 3,
+          jsgraph()->Int32Constant(shared->internal_formal_parameter_count()));
+      NodeProperties::ChangeOp(
+          node, common()->Call(Linkage::GetStubCallDescriptor(
+                    isolate(), graph()->zone(), callable.descriptor(),
+                    1 + arity, flags)));
     }
+    return Changed(node);
   }
 
   return NoChange();