[turbofan] Add support to lower Function.prototype.call.

src/compiler/js-builtin-reducer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/diamond.h"
 #include "src/compiler/js-builtin-reducer.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/simplified-operator.h"
@@ skipping 73 matching lines @@
 
  private:
   Node* node_;
 };
 
 
 JSBuiltinReducer::JSBuiltinReducer(Editor* editor, JSGraph* jsgraph)
     : AdvancedReducer(editor), jsgraph_(jsgraph) {}
 
 
+// ES6 section 19.2.3.3 Function.prototype.call (thisArg, ...args)
+Reduction JSBuiltinReducer::ReduceFunctionCall(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCallFunction, node->opcode());
+  CallFunctionParameters const& p = CallFunctionParametersOf(node->op());
+  Handle<JSFunction> apply = Handle<JSFunction>::cast(
+      HeapObjectMatcher(NodeProperties::GetValueInput(node, 0)).Value());
+  // Change context of {node} to the Function.prototype.call context,
+  // to ensure any exception is thrown in the correct context.
+  NodeProperties::ReplaceContextInput(
+      node, jsgraph()->HeapConstant(handle(apply->context(), isolate())));
+  // Remove the target from {node} and use the receiver as target instead, and
+  // the thisArg becomes the new target.  If thisArg was not provided, insert
+  // undefined instead.
+  size_t arity = p.arity();
+  DCHECK_LE(2u, arity);
+  ConvertReceiverMode convert_mode;
+  if (arity == 2) {
+    // The thisArg was not provided, use undefined as receiver.
+    convert_mode = ConvertReceiverMode::kNullOrUndefined;
+    node->ReplaceInput(0, node->InputAt(1));
+    node->ReplaceInput(1, jsgraph()->UndefinedConstant());
+  } else {
+    // Just remove the target, which is the first value input.
+    convert_mode = ConvertReceiverMode::kAny;
+    node->RemoveInput(0);
+    --arity;
+  }
+  // TODO(turbofan): Migrate the call count to the new operator?
+  NodeProperties::ChangeOp(node, javascript()->CallFunction(
+                                     arity, p.language_mode(), VectorSlotPair(),
+                                     convert_mode, p.tail_call_mode()));
+  return Changed(node);
+}
+
+
 // ECMA-262, section 15.8.2.11.
 Reduction JSBuiltinReducer::ReduceMathMax(Node* node) {
   JSCallReduction r(node);
   if (r.InputsMatchZero()) {
     // Math.max() -> -Infinity
     return Replace(jsgraph()->Constant(-V8_INFINITY));
   }
   if (r.InputsMatchOne(Type::Number())) {
     // Math.max(a:number) -> a
     return Replace(r.left());
@@ skipping 39 matching lines @@
 }
 
 
 Reduction JSBuiltinReducer::Reduce(Node* node) {
   Reduction reduction = NoChange();
   JSCallReduction r(node);
 
   // Dispatch according to the BuiltinFunctionId if present.
   if (!r.HasBuiltinFunctionId()) return NoChange();
   switch (r.GetBuiltinFunctionId()) {
+    case kFunctionCall:
+      return ReduceFunctionCall(node);
     case kMathMax:
       reduction = ReduceMathMax(node);
       break;
     case kMathImul:
       reduction = ReduceMathImul(node);
       break;
     case kMathFround:
       reduction = ReduceMathFround(node);
       break;
     default:
       break;
   }
 
   // Replace builtin call assuming replacement nodes are pure values that don't
   // produce an effect. Replaces {node} with {reduction} and relaxes effects.
   if (reduction.Changed()) ReplaceWithValue(node, reduction.replacement());
 
   return reduction;
 }
 
 
 Graph* JSBuiltinReducer::graph() const { return jsgraph()->graph(); }
 
 
+Isolate* JSBuiltinReducer::isolate() const { return jsgraph()->isolate(); }
+
+
 CommonOperatorBuilder* JSBuiltinReducer::common() const {
   return jsgraph()->common();
 }
 
 
 MachineOperatorBuilder* JSBuiltinReducer::machine() const {
   return jsgraph()->machine();
 }
 
 
 SimplifiedOperatorBuilder* JSBuiltinReducer::simplified() const {
   return jsgraph()->simplified();
 }
 
+
+JSOperatorBuilder* JSBuiltinReducer::javascript() const {
+  return jsgraph()->javascript();
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8