[turbofan] Replace uninitialized JSCall nodes with SOFT deopt.

src/compiler/js-call-reducer.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-call-reducer.h"
 
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 931 matching lines @@
 
     // Don't mess with other {node}s that have a constant {target}.
     // TODO(bmeurer): Also support proxies here.
     return NoChange();
   }
 
   // Extract feedback from the {node} using the CallICNexus.
   if (!p.feedback().IsValid()) return NoChange();
   CallICNexus nexus(p.feedback().vector(), p.feedback().slot());
   if (nexus.IsUninitialized()) {
-    // TODO(turbofan): Tail-calling to a CallIC stub is not supported.
-    if (p.tail_call_mode() == TailCallMode::kAllow) return NoChange();
-
-    // Insert a CallIC here to collect feedback for uninitialized calls.
-    int const arg_count = static_cast<int>(p.arity() - 2);
-    Callable callable = CodeFactory::CallIC(isolate(), p.convert_mode());
-    CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
-    CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
-        isolate(), graph()->zone(), callable.descriptor(), arg_count + 1,
-        flags);
-    Node* stub_code = jsgraph()->HeapConstant(callable.code());
-    Node* stub_arity = jsgraph()->Constant(arg_count);
-    Node* slot_index =
-        jsgraph()->Constant(FeedbackVector::GetIndex(p.feedback().slot()));
-    Node* feedback_vector = jsgraph()->HeapConstant(p.feedback().vector());
-    node->InsertInput(graph()->zone(), 0, stub_code);
-    node->InsertInput(graph()->zone(), 2, stub_arity);
-    node->InsertInput(graph()->zone(), 3, slot_index);
-    node->InsertInput(graph()->zone(), 4, feedback_vector);
-    NodeProperties::ChangeOp(node, common()->Call(desc));
-    return Changed(node);
+    if (flags() & kBailoutOnUninitialized) {
+      // Introduce a SOFT deopt if the call {node} wasn't executed so far.
+      Node* frame_state = NodeProperties::FindFrameStateBefore(node);
+      Node* deoptimize = graph()->NewNode(
+          common()->Deoptimize(
+              DeoptimizeKind::kSoft,
+              DeoptimizeReason::kInsufficientTypeFeedbackForCall),
+          frame_state, effect, control);
+      // TODO(bmeurer): This should be on the AdvancedReducer somehow.
+      NodeProperties::MergeControlToEnd(graph(), common(), deoptimize);
+      Revisit(graph()->end());
+      node->TrimInputCount(0);
+      NodeProperties::ChangeOp(node, common()->Dead());
+      return Changed(node);
+    }
+    return NoChange();
   }
 
   Handle<Object> feedback(nexus.GetFeedback(), isolate());
   if (feedback->IsAllocationSite()) {
     // Retrieve the Array function from the {node}.
     Node* array_function = jsgraph()->HeapConstant(
         handle(native_context()->array_function(), isolate()));
 
     // Check that the {target} is still the {array_function}.
     Node* check = graph()->NewNode(simplified()->ReferenceEqual(), target,
@@ skipping 208 matching lines @@
   return jsgraph()->javascript();
 }
 
 SimplifiedOperatorBuilder* JSCallReducer::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8