[turbofan] fix wrong materialization of arguments object

src/compiler/js-call-reducer.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-call-reducer.h"
 
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/js-graph.h"
@@ skipping 99 matching lines @@
       if (!NodeProperties::IsValueEdge(edge)) continue;
       if (edge.from() == node) continue;
       return NoChange();
     }
     // Check if the arguments can be handled in the fast case (i.e. we don't
     // have aliased sloppy arguments), and compute the {start_index} for
     // rest parameters.
     CreateArgumentsType const type = CreateArgumentsTypeOf(arg_array->op());
     Node* frame_state = NodeProperties::GetFrameStateInput(arg_array);
     FrameStateInfo state_info = OpParameter<FrameStateInfo>(frame_state);
+    int formal_parameter_count;
     int start_index = 0;
+    {
+      Handle<SharedFunctionInfo> shared;
+      if (!state_info.shared_info().ToHandle(&shared)) return NoChange();
+      formal_parameter_count = shared->internal_formal_parameter_count();
+    }
     if (type == CreateArgumentsType::kMappedArguments) {
       // Mapped arguments (sloppy mode) cannot be handled if they are aliased.
-      Handle<SharedFunctionInfo> shared;
-      if (!state_info.shared_info().ToHandle(&shared)) return NoChange();
-      if (shared->internal_formal_parameter_count() != 0) return NoChange();
+      if (formal_parameter_count != 0) return NoChange();
     } else if (type == CreateArgumentsType::kRestParameter) {
-      Handle<SharedFunctionInfo> shared;
-      if (!state_info.shared_info().ToHandle(&shared)) return NoChange();
-      start_index = shared->internal_formal_parameter_count();
+      start_index = formal_parameter_count;
     }
     // Check if are applying to inlined arguments or to the arguments of
     // the outermost function.
     Node* outer_state = frame_state->InputAt(kFrameStateOuterStateInput);
     if (outer_state->opcode() != IrOpcode::kFrameState) {
       // TODO(jarin,bmeurer): Support the NewUnmappedArgumentsElement and
       // NewRestParameterElements in the EscapeAnalysis and Deoptimizer
       // instead, then we don't need this hack.
-      if (type != CreateArgumentsType::kRestParameter) {
+      // Only works with zero formal parameters because of lacking deoptimizer
+      // support.
+      if (type != CreateArgumentsType::kRestParameter &&
+          formal_parameter_count == 0) {
         // There are no other uses of the {arg_array} except in StateValues,
         // so we just replace {arg_array} with a marker for the Deoptimizer
         // that this refers to the arguments object.
         Node* arguments = graph()->NewNode(common()->ArgumentsObjectState());
         ReplaceWithValue(arg_array, arguments);
       }
 
       // Reduce {node} to a JSCallForwardVarargs operation, which just
       // re-pushes the incoming arguments and calls the {target}.
       node->RemoveInput(0);  // Function.prototype.apply
@@ skipping 634 matching lines @@
   return jsgraph()->javascript();
 }
 
 SimplifiedOperatorBuilder* JSCallReducer::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8