[turbofan] Ignore accumulator uses in frame state for the apply-argument optimization decision.

src/compiler/js-call-reducer.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-call-reducer.h"
 
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/js-graph.h"
@@ skipping 106 matching lines @@
   } else if (arity == 3) {
     // The argArray was not provided, just remove the {target}.
     node->RemoveInput(0);
     --arity;
   } else if (arity == 4) {
     // Check if argArray is an arguments object, and {node} is the only value
     // user of argArray (except for value uses in frame states).
     Node* arg_array = NodeProperties::GetValueInput(node, 3);
     if (arg_array->opcode() != IrOpcode::kJSCreateArguments) return NoChange();
     for (Edge edge : arg_array->use_edges()) {
-      if (edge.from()->opcode() == IrOpcode::kStateValues) continue;
+      Node* user = edge.from();
+      // Ignore uses as frame state's locals or parameters.
+      if (user->opcode() == IrOpcode::kStateValues) continue;
+      // Ignore uses as frame state's accumulator.
+      if (user->opcode() == IrOpcode::kFrameState &&
+          user->InputAt(2) == arg_array) {
+        continue;
+      }
       if (!NodeProperties::IsValueEdge(edge)) continue;
       if (edge.from() == node) continue;
       return NoChange();
     }
     // Check if the arguments can be handled in the fast case (i.e. we don't
     // have aliased sloppy arguments), and compute the {start_index} for
     // rest parameters.
     CreateArgumentsType const type = CreateArgumentsTypeOf(arg_array->op());
     Node* frame_state = NodeProperties::GetFrameStateInput(arg_array);
     FrameStateInfo state_info = OpParameter<FrameStateInfo>(frame_state);
@@ skipping 713 matching lines @@
   return jsgraph()->javascript();
 }
 
 SimplifiedOperatorBuilder* JSCallReducer::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8