[turbofan] Introduce new JSCallWithArrayLike operator.

src/compiler/js-call-reducer.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-call-reducer.h"
 
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 10 matching lines @@
 namespace compiler {
 
 Reduction JSCallReducer::Reduce(Node* node) {
   switch (node->opcode()) {
     case IrOpcode::kJSConstruct:
       return ReduceJSConstruct(node);
     case IrOpcode::kJSConstructWithSpread:
       return ReduceJSConstructWithSpread(node);
     case IrOpcode::kJSCall:
       return ReduceJSCall(node);
+    case IrOpcode::kJSCallWithArrayLike:
+      return ReduceJSCallWithArrayLike(node);
     case IrOpcode::kJSCallWithSpread:
       return ReduceJSCallWithSpread(node);
     default:
       break;
   }
   return NoChange();
 }
 
 
 // ES6 section 22.1.1 The Array Constructor
@@ skipping 47 matching lines @@
 
   // Turn the {node} into a {JSToNumber} call.
   DCHECK_LE(2u, p.arity());
   Node* value = (p.arity() == 2) ? jsgraph()->ZeroConstant()
                                  : NodeProperties::GetValueInput(node, 2);
   NodeProperties::ReplaceValueInputs(node, value);
   NodeProperties::ChangeOp(node, javascript()->ToNumber());
   return Changed(node);
 }
 
+namespace {
+
+bool CanBeNullOrUndefined(Node* node) {
+  switch (node->opcode()) {
+    case IrOpcode::kJSCreate:
+    case IrOpcode::kJSCreateArguments:
+    case IrOpcode::kJSCreateArray:
+    case IrOpcode::kJSCreateClosure:
+    case IrOpcode::kJSCreateIterResultObject:
+    case IrOpcode::kJSCreateKeyValueArray:
+    case IrOpcode::kJSCreateLiteralArray:
+    case IrOpcode::kJSCreateLiteralObject:
+    case IrOpcode::kJSCreateLiteralRegExp:
+    case IrOpcode::kJSConstruct:
+    case IrOpcode::kJSConstructForwardVarargs:
+    case IrOpcode::kJSConstructWithSpread:
+    case IrOpcode::kJSConvertReceiver:
+    case IrOpcode::kJSToBoolean:
+    case IrOpcode::kJSToInteger:
+    case IrOpcode::kJSToLength:
+    case IrOpcode::kJSToName:
+    case IrOpcode::kJSToNumber:
+    case IrOpcode::kJSToObject:
+    case IrOpcode::kJSToString:
+    case IrOpcode::kJSToPrimitiveToString:
+      return false;
+    case IrOpcode::kHeapConstant: {
+      Handle<HeapObject> value = HeapObjectMatcher(node).Value();
+      Isolate* const isolate = value->GetIsolate();
+      return value->IsNull(isolate) || value->IsUndefined(isolate);
+    }
+    default:
+      return true;
+  }
+}
+
+}  // namespace
 
 // ES6 section 19.2.3.1 Function.prototype.apply ( thisArg, argArray )
 Reduction JSCallReducer::ReduceFunctionPrototypeApply(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  Node* target = NodeProperties::GetValueInput(node, 0);
   CallParameters const& p = CallParametersOf(node->op());
   // Tail calls to Function.prototype.apply are not properly supported
   // down the pipeline, so we disable this optimization completely for
   // tail calls (for now).
   if (p.tail_call_mode() == TailCallMode::kAllow) return NoChange();
-  Handle<JSFunction> apply =
-      Handle<JSFunction>::cast(HeapObjectMatcher(target).Value());
   size_t arity = p.arity();
   DCHECK_LE(2u, arity);
   ConvertReceiverMode convert_mode = ConvertReceiverMode::kAny;
   if (arity == 2) {
     // Neither thisArg nor argArray was provided.
     convert_mode = ConvertReceiverMode::kNullOrUndefined;
     node->ReplaceInput(0, node->InputAt(1));
     node->ReplaceInput(1, jsgraph()->UndefinedConstant());
   } else if (arity == 3) {
     // The argArray was not provided, just remove the {target}.
     node->RemoveInput(0);
     --arity;
-  } else if (arity == 4) {
-    // Check if argArray is an arguments object, and {node} is the only value
-    // user of argArray (except for value uses in frame states).
-    Node* arg_array = NodeProperties::GetValueInput(node, 3);
-    if (arg_array->opcode() != IrOpcode::kJSCreateArguments) return NoChange();
-    for (Edge edge : arg_array->use_edges()) {
-      Node* const user = edge.from();
-      if (user == node) continue;
-      // Ignore uses as frame state's locals or parameters.
-      if (user->opcode() == IrOpcode::kStateValues) continue;
-      // Ignore uses as frame state's accumulator.
-      if (user->opcode() == IrOpcode::kFrameState &&
-          user->InputAt(2) == arg_array) {
-        continue;
+  } else {
+    Node* target = NodeProperties::GetValueInput(node, 1);
+    Node* this_argument = NodeProperties::GetValueInput(node, 2);
+    Node* arguments_list = NodeProperties::GetValueInput(node, 3);
+    Node* context = NodeProperties::GetContextInput(node);
+    Node* frame_state = NodeProperties::GetFrameStateInput(node);
+    Node* effect = NodeProperties::GetEffectInput(node);
+    Node* control = NodeProperties::GetControlInput(node);
+
+    // If {arguments_list} cannot be null or undefined, we don't need
+    // to expand this {node} to control-flow.
+    if (!CanBeNullOrUndefined(arguments_list)) {
+      // Massage the value inputs appropriately.
+      node->ReplaceInput(0, target);
+      node->ReplaceInput(1, this_argument);
+      node->ReplaceInput(2, arguments_list);
+      while (arity-- > 3) node->RemoveInput(3);
+
+      // Morph the {node} to a {JSCallWithArrayLike}.
+      NodeProperties::ChangeOp(node,
+                               javascript()->CallWithArrayLike(p.frequency()));
+      Reduction const reduction = ReduceJSCallWithArrayLike(node);
+      return reduction.Changed() ? reduction : Changed(node);
+    } else {
+      // Check whether {arguments_list} is null.
+      Node* check_null =
+          graph()->NewNode(simplified()->ReferenceEqual(), arguments_list,
+                           jsgraph()->NullConstant());
+      control = graph()->NewNode(common()->Branch(BranchHint::kFalse),
+                                 check_null, control);
+      Node* if_null = graph()->NewNode(common()->IfTrue(), control);
+      control = graph()->NewNode(common()->IfFalse(), control);
+
+      // Check whether {arguments_list} is undefined.
+      Node* check_undefined =
+          graph()->NewNode(simplified()->ReferenceEqual(), arguments_list,
+                           jsgraph()->UndefinedConstant());
+      control = graph()->NewNode(common()->Branch(BranchHint::kFalse),
+                                 check_undefined, control);
+      Node* if_undefined = graph()->NewNode(common()->IfTrue(), control);
+      control = graph()->NewNode(common()->IfFalse(), control);
+
+      // Lower to {JSCallWithArrayLike} if {arguments_list} is neither null
+      // nor undefined.
+      Node* effect0 = effect;
+      Node* control0 = control;
+      Node* value0 = effect0 = control0 = graph()->NewNode(
+          javascript()->CallWithArrayLike(p.frequency()), target, this_argument,
+          arguments_list, context, frame_state, effect0, control0);
+
+      // Lower to {JSCall} if {arguments_list} is either null or undefined.
+      Node* effect1 = effect;
+      Node* control1 =
+          graph()->NewNode(common()->Merge(2), if_null, if_undefined);
+      Node* value1 = effect1 = control1 =
+          graph()->NewNode(javascript()->Call(2), target, this_argument,
+                           context, frame_state, effect1, control1);
+
+      // Rewire potential exception edges.
+      Node* if_exception = nullptr;
+      if (NodeProperties::IsExceptionalCall(node, &if_exception)) {
+        // Create appropriate {IfException} and {IfSuccess} nodes.
+        Node* if_exception0 =
+            graph()->NewNode(common()->IfException(), control0, effect0);
+        control0 = graph()->NewNode(common()->IfSuccess(), control0);
+        Node* if_exception1 =
+            graph()->NewNode(common()->IfException(), control1, effect1);
+        control1 = graph()->NewNode(common()->IfSuccess(), control1);
+
+        // Join the exception edges.
+        Node* merge =
+            graph()->NewNode(common()->Merge(2), if_exception0, if_exception1);
+        Node* ephi = graph()->NewNode(common()->EffectPhi(2), if_exception0,
+                                      if_exception1, merge);
+        Node* phi =
+            graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                             if_exception0, if_exception1, merge);
+        ReplaceWithValue(if_exception, phi, ephi, merge);
       }
-      if (!NodeProperties::IsValueEdge(edge)) continue;
-      return NoChange();
+
+      // Join control paths.
+      control = graph()->NewNode(common()->Merge(2), control0, control1);
+      effect =
+          graph()->NewNode(common()->EffectPhi(2), effect0, effect1, control);
+      Node* value =
+          graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                           value0, value1, control);
+      ReplaceWithValue(node, value, effect, control);
+      return Replace(value);
     }
-    // Check if the arguments can be handled in the fast case (i.e. we don't
-    // have aliased sloppy arguments), and compute the {start_index} for
-    // rest parameters.
-    CreateArgumentsType const type = CreateArgumentsTypeOf(arg_array->op());
-    Node* frame_state = NodeProperties::GetFrameStateInput(arg_array);
-    FrameStateInfo state_info = OpParameter<FrameStateInfo>(frame_state);
-    int start_index = 0;
-    // Determine the formal parameter count;
-    Handle<SharedFunctionInfo> shared;
-    if (!state_info.shared_info().ToHandle(&shared)) return NoChange();
-    int formal_parameter_count = shared->internal_formal_parameter_count();
-    if (type == CreateArgumentsType::kMappedArguments) {
-      // Mapped arguments (sloppy mode) that are aliased can only be handled
-      // here if there's no side-effect between the {node} and the {arg_array}.
-      // TODO(turbofan): Further relax this constraint.
-      if (formal_parameter_count != 0) {
-        Node* effect = NodeProperties::GetEffectInput(node);
-        while (effect != arg_array) {
-          if (effect->op()->EffectInputCount() != 1 ||
-              !(effect->op()->properties() & Operator::kNoWrite)) {
-            return NoChange();
-          }
-          effect = NodeProperties::GetEffectInput(effect);
-        }
-      }
-    } else if (type == CreateArgumentsType::kRestParameter) {
-      start_index = formal_parameter_count;
-    }
-    // Check if are applying to inlined arguments or to the arguments of
-    // the outermost function.
-    Node* outer_state = frame_state->InputAt(kFrameStateOuterStateInput);
-    if (outer_state->opcode() != IrOpcode::kFrameState) {
-      // Reduce {node} to a JSCallForwardVarargs operation, which just
-      // re-pushes the incoming arguments and calls the {target}.
-      node->RemoveInput(0);  // Function.prototype.apply
-      node->RemoveInput(2);  // arguments
-      NodeProperties::ChangeOp(node, javascript()->CallForwardVarargs(
-                                         2, start_index, p.tail_call_mode()));
-      return Changed(node);
-    }
-    // Get to the actual frame state from which to extract the arguments;
-    // we can only optimize this in case the {node} was already inlined into
-    // some other function (and same for the {arg_array}).
-    FrameStateInfo outer_info = OpParameter<FrameStateInfo>(outer_state);
-    if (outer_info.type() == FrameStateType::kArgumentsAdaptor) {
-      // Need to take the parameters from the arguments adaptor.
-      frame_state = outer_state;
-    }
-    // Remove the argArray input from the {node}.
-    node->RemoveInput(static_cast<int>(--arity));
-    // Add the actual parameters to the {node}, skipping the receiver,
-    // starting from {start_index}.
-    Node* const parameters = frame_state->InputAt(kFrameStateParametersInput);
-    for (int i = start_index + 1; i < parameters->InputCount(); ++i) {
-      node->InsertInput(graph()->zone(), static_cast<int>(arity),
-                        parameters->InputAt(i));
-      ++arity;
-    }
-    // Drop the {target} from the {node}.
-    node->RemoveInput(0);
-    --arity;
-  } else {
-    return NoChange();
   }
   // Change {node} to the new {JSCall} operator.
   NodeProperties::ChangeOp(
       node,
       javascript()->Call(arity, p.frequency(), VectorSlotPair(), convert_mode,
                          p.tail_call_mode()));
-  // Change context of {node} to the Function.prototype.apply context,
-  // to ensure any exception is thrown in the correct context.
-  NodeProperties::ReplaceContextInput(
-      node, jsgraph()->HeapConstant(handle(apply->context(), isolate())));
   // Try to further reduce the JSCall {node}.
   Reduction const reduction = ReduceJSCall(node);
   return reduction.Changed() ? reduction : Changed(node);
 }
 
 
 // ES6 section 19.2.3.3 Function.prototype.call (thisArg, ...args)
 Reduction JSCallReducer::ReduceFunctionPrototypeCall(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
@@ skipping 144 matching lines @@
   // JSHasInPrototypeChain operator immediately aborts and yields false.
   NodeProperties::ReplaceValueInput(node, value, 0);
   NodeProperties::ReplaceValueInput(node, receiver, 1);
   for (int i = node->op()->ValueInputCount(); i-- > 2;) {
     node->RemoveInput(i);
   }
   NodeProperties::ChangeOp(node, javascript()->HasInPrototypeChain());
   return Changed(node);
 }
 
+// ES6 section 26.1.1 Reflect.apply ( target, thisArgument, argumentsList )
+Reduction JSCallReducer::ReduceReflectApply(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
+  int arity = static_cast<int>(p.arity() - 2);
+  DCHECK_LE(0, arity);
+  // Massage value inputs appropriately.
+  node->RemoveInput(0);
+  node->RemoveInput(0);
+  while (arity < 3) {
+    node->InsertInput(graph()->zone(), arity++, jsgraph()->UndefinedConstant());
+  }
+  while (arity-- > 3) {
+    node->RemoveInput(arity);
+  }
+  NodeProperties::ChangeOp(node,
+                           javascript()->CallWithArrayLike(p.frequency()));
+  Reduction const reduction = ReduceJSCallWithArrayLike(node);
+  return reduction.Changed() ? reduction : Changed(node);
+}
+
 // ES6 section 26.1.7 Reflect.getPrototypeOf ( target )
 Reduction JSCallReducer::ReduceReflectGetPrototypeOf(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   Node* target = (node->op()->ValueInputCount() >= 3)
                      ? NodeProperties::GetValueInput(node, 2)
                      : jsgraph()->UndefinedConstant();
   return ReduceObjectGetPrototype(node, target);
 }
 
 Reduction JSCallReducer::ReduceArrayForEach(Handle<JSFunction> function,
@@ skipping 204 matching lines @@
                     jsgraph()->HeapConstant(stub.GetCode()));
   node->InsertInput(graph()->zone(), 2, jsgraph()->Constant(data));
   node->InsertInput(graph()->zone(), 3, holder);
   node->InsertInput(graph()->zone(), 4,
                     jsgraph()->ExternalConstant(function_reference));
   node->ReplaceInput(5, receiver);
   NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
   return Changed(node);
 }
 
-Reduction JSCallReducer::ReduceSpreadCall(Node* node, int arity) {
-  DCHECK(node->opcode() == IrOpcode::kJSCallWithSpread ||
+Reduction JSCallReducer::ReduceCallOrConstructWithArrayLikeOrSpread(
+    Node* node, int arity, CallFrequency const& frequency) {
+  DCHECK(node->opcode() == IrOpcode::kJSCallWithArrayLike ||
+         node->opcode() == IrOpcode::kJSCallWithSpread ||
          node->opcode() == IrOpcode::kJSConstructWithSpread);
 
-  // Do check to make sure we can actually avoid iteration.
-  if (!isolate()->initial_array_iterator_prototype_map()->is_stable()) {
+  // In case of a call/construct with spread, we need to
+  // ensure that it's safe to avoid the actual iteration.
+  if ((node->opcode() == IrOpcode::kJSCallWithSpread ||
+       node->opcode() == IrOpcode::kJSConstructWithSpread) &&
+      !isolate()->initial_array_iterator_prototype_map()->is_stable()) {
     return NoChange();
   }
 
-  Node* spread = NodeProperties::GetValueInput(node, arity);
-
-  // Check if spread is an arguments object, and {node} is the only value user
-  // of spread (except for value uses in frame states).
-  if (spread->opcode() != IrOpcode::kJSCreateArguments) return NoChange();
-  for (Edge edge : spread->use_edges()) {
+  // Check if {arguments_list} is an arguments object, and {node} is the only
+  // value user of {arguments_list} (except for value uses in frame states).
+  Node* arguments_list = NodeProperties::GetValueInput(node, arity);
+  if (arguments_list->opcode() != IrOpcode::kJSCreateArguments)
+    return NoChange();
+  for (Edge edge : arguments_list->use_edges()) {
     Node* const user = edge.from();
     if (user == node) continue;
     // Ignore uses as frame state's locals or parameters.
     if (user->opcode() == IrOpcode::kStateValues) continue;
     // Ignore uses as frame state's accumulator.
-    if (user->opcode() == IrOpcode::kFrameState && user->InputAt(2) == spread) {
+    if (user->opcode() == IrOpcode::kFrameState &&
+        user->InputAt(2) == arguments_list) {
       continue;
     }
     if (!NodeProperties::IsValueEdge(edge)) continue;
     return NoChange();
   }
 
   // Get to the actual frame state from which to extract the arguments;
   // we can only optimize this in case the {node} was already inlined into
-  // some other function (and same for the {spread}).
-  CreateArgumentsType const type = CreateArgumentsTypeOf(spread->op());
-  Node* frame_state = NodeProperties::GetFrameStateInput(spread);
+  // some other function (and same for the {arguments_list}).
+  CreateArgumentsType const type = CreateArgumentsTypeOf(arguments_list->op());
+  Node* frame_state = NodeProperties::GetFrameStateInput(arguments_list);
   FrameStateInfo state_info = OpParameter<FrameStateInfo>(frame_state);
   int start_index = 0;
   // Determine the formal parameter count;
   Handle<SharedFunctionInfo> shared;
   if (!state_info.shared_info().ToHandle(&shared)) return NoChange();
   int formal_parameter_count = shared->internal_formal_parameter_count();
   if (type == CreateArgumentsType::kMappedArguments) {
     // Mapped arguments (sloppy mode) that are aliased can only be handled
     // here if there's no side-effect between the {node} and the {arg_array}.
     // TODO(turbofan): Further relax this constraint.
     if (formal_parameter_count != 0) {
       Node* effect = NodeProperties::GetEffectInput(node);
-      while (effect != spread) {
+      while (effect != arguments_list) {
         if (effect->op()->EffectInputCount() != 1 ||
             !(effect->op()->properties() & Operator::kNoWrite)) {
           return NoChange();
         }
         effect = NodeProperties::GetEffectInput(effect);
       }
     }
   } else if (type == CreateArgumentsType::kRestParameter) {
     start_index = formal_parameter_count;
 
-    // Only check the array iterator protector when we have a rest object.
-    if (!isolate()->IsArrayIteratorLookupChainIntact()) return NoChange();
+    // For spread calls/constructs with rest parameters we need to ensure that
+    // the array iterator protector is intact, which guards that the rest
+    // parameter iteration is not observable.
+    if (node->opcode() == IrOpcode::kJSCallWithSpread ||
+        node->opcode() == IrOpcode::kJSConstructWithSpread) {
+      if (!isolate()->IsArrayIteratorLookupChainIntact()) return NoChange();
+      dependencies()->AssumePropertyCell(factory()->array_iterator_protector());
+    }
   }
 
-  // Install appropriate code dependencies.
-  dependencies()->AssumeMapStable(
-      isolate()->initial_array_iterator_prototype_map());
-  if (type == CreateArgumentsType::kRestParameter) {
-    dependencies()->AssumePropertyCell(factory()->array_iterator_protector());
+  // For call/construct with spread, we need to also install a code
+  // dependency on the initial %ArrayIteratorPrototype% map here to
+  // ensure that no one messes with the next method.
+  if (node->opcode() == IrOpcode::kJSCallWithSpread ||
+      node->opcode() == IrOpcode::kJSConstructWithSpread) {
+    dependencies()->AssumeMapStable(
+        isolate()->initial_array_iterator_prototype_map());
   }
-  // Remove the spread input from the {node}.
+
+  // Remove the {arguments_list} input from the {node}.
   node->RemoveInput(arity--);
   // Check if are spreading to inlined arguments or to the arguments of
   // the outermost function.
   Node* outer_state = frame_state->InputAt(kFrameStateOuterStateInput);
   if (outer_state->opcode() != IrOpcode::kFrameState) {
     Operator const* op =
-        (node->opcode() == IrOpcode::kJSCallWithSpread)
+        (node->opcode() == IrOpcode::kJSCallWithArrayLike ||
+         node->opcode() == IrOpcode::kJSCallWithSpread)
             ? javascript()->CallForwardVarargs(arity + 1, start_index,
                                                TailCallMode::kDisallow)
             : javascript()->ConstructForwardVarargs(arity + 2, start_index);
     NodeProperties::ChangeOp(node, op);
     return Changed(node);
   }
   // Get to the actual frame state from which to extract the arguments;
   // we can only optimize this in case the {node} was already inlined into
   // some other function (and same for the {arg_array}).
   FrameStateInfo outer_info = OpParameter<FrameStateInfo>(outer_state);
   if (outer_info.type() == FrameStateType::kArgumentsAdaptor) {
     // Need to take the parameters from the arguments adaptor.
     frame_state = outer_state;
   }
   // Add the actual parameters to the {node}, skipping the receiver.
   Node* const parameters = frame_state->InputAt(kFrameStateParametersInput);
   for (int i = start_index + 1; i < parameters->InputCount(); ++i) {
     node->InsertInput(graph()->zone(), static_cast<int>(++arity),
                       parameters->InputAt(i));
   }
 
-  // TODO(turbofan): Collect call counts on spread call/construct and thread it
-  // through here.
-  if (node->opcode() == IrOpcode::kJSCallWithSpread) {
-    NodeProperties::ChangeOp(node, javascript()->Call(arity + 1));
-    Reduction const r = ReduceJSCall(node);
-    return r.Changed() ? r : Changed(node);
+  if (node->opcode() == IrOpcode::kJSCallWithArrayLike ||
+      node->opcode() == IrOpcode::kJSCallWithSpread) {
+    NodeProperties::ChangeOp(node, javascript()->Call(arity + 1, frequency));
+    Reduction const reduction = ReduceJSCall(node);
+    return reduction.Changed() ? reduction : Changed(node);
   } else {
-    NodeProperties::ChangeOp(node, javascript()->Construct(arity + 2));
-    Reduction const r = ReduceJSConstruct(node);
-    return r.Changed() ? r : Changed(node);
+    NodeProperties::ChangeOp(node,
+                             javascript()->Construct(arity + 2, frequency));
+    Reduction const reduction = ReduceJSConstruct(node);
+    return reduction.Changed() ? reduction : Changed(node);
   }
 }
 
 namespace {
 
 bool ShouldUseCallICFeedback(Node* node) {
   HeapObjectMatcher m(node);
   if (m.HasValue() || m.IsJSCreateClosure()) {
     // Don't use CallIC feedback when we know the function
     // being called, i.e. either know the closure itself or
@@ skipping 53 matching lines @@
         case Builtins::kFunctionPrototypeHasInstance:
           return ReduceFunctionPrototypeHasInstance(node);
         case Builtins::kNumberConstructor:
           return ReduceNumberConstructor(node);
         case Builtins::kObjectGetPrototypeOf:
           return ReduceObjectGetPrototypeOf(node);
         case Builtins::kObjectPrototypeGetProto:
           return ReduceObjectPrototypeGetProto(node);
         case Builtins::kObjectPrototypeIsPrototypeOf:
           return ReduceObjectPrototypeIsPrototypeOf(node);
+        case Builtins::kReflectApply:
+          return ReduceReflectApply(node);
         case Builtins::kReflectGetPrototypeOf:
           return ReduceReflectGetPrototypeOf(node);
         case Builtins::kArrayForEach:
           return ReduceArrayForEach(function, node);
         case Builtins::kReturnReceiver:
           return ReduceReturnReceiver(node);
         default:
           break;
       }
 
@@ skipping 110 matching lines @@
       NodeProperties::ReplaceEffectInput(node, effect);
 
       // Try to further reduce the JSCall {node}.
       Reduction const reduction = ReduceJSCall(node);
       return reduction.Changed() ? reduction : Changed(node);
     }
   }
   return NoChange();
 }
 
+Reduction JSCallReducer::ReduceJSCallWithArrayLike(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCallWithArrayLike, node->opcode());
+  CallFrequency frequency = CallFrequencyOf(node->op());
+  return ReduceCallOrConstructWithArrayLikeOrSpread(node, 2, frequency);
+}
+
 Reduction JSCallReducer::ReduceJSCallWithSpread(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCallWithSpread, node->opcode());
   SpreadWithArityParameter const& p = SpreadWithArityParameterOf(node->op());
   DCHECK_LE(3u, p.arity());
   int arity = static_cast<int>(p.arity() - 1);
 
-  return ReduceSpreadCall(node, arity);
+  // TODO(turbofan): Collect call counts on spread call/construct and thread it
+  // through here.
+  CallFrequency frequency;
+  return ReduceCallOrConstructWithArrayLikeOrSpread(node, arity, frequency);
 }
 
 Reduction JSCallReducer::ReduceJSConstruct(Node* node) {
   DCHECK_EQ(IrOpcode::kJSConstruct, node->opcode());
   ConstructParameters const& p = ConstructParametersOf(node->op());
   DCHECK_LE(2u, p.arity());
   int const arity = static_cast<int>(p.arity() - 2);
   Node* target = NodeProperties::GetValueInput(node, 0);
   Node* new_target = NodeProperties::GetValueInput(node, arity + 1);
   Node* effect = NodeProperties::GetEffectInput(node);
@@ skipping 103 matching lines @@
 
   return NoChange();
 }
 
 Reduction JSCallReducer::ReduceJSConstructWithSpread(Node* node) {
   DCHECK_EQ(IrOpcode::kJSConstructWithSpread, node->opcode());
   SpreadWithArityParameter const& p = SpreadWithArityParameterOf(node->op());
   DCHECK_LE(3u, p.arity());
   int arity = static_cast<int>(p.arity() - 2);
 
-  return ReduceSpreadCall(node, arity);
+  // TODO(turbofan): Collect call counts on spread call/construct and thread it
+  // through here.
+  CallFrequency frequency;
+  return ReduceCallOrConstructWithArrayLikeOrSpread(node, arity, frequency);
 }
 
 Reduction JSCallReducer::ReduceReturnReceiver(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   Node* receiver = NodeProperties::GetValueInput(node, 1);
   ReplaceWithValue(node, receiver);
   return Replace(receiver);
 }
 
 Graph* JSCallReducer::graph() const { return jsgraph()->graph(); }
@@ skipping 15 matching lines @@
   return jsgraph()->javascript();
 }
 
 SimplifiedOperatorBuilder* JSCallReducer::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8