From 168eb163a71eca13dd8bbe5854d5589aa885e065 Mon Sep 17 00:00:00 2001
From: jarin <jarin@chromium.org>
Date: Mon, 15 May 2017 01:35:40 -0700
Subject: [PATCH] [turbofan] Ignore accumulator uses in frame state for the
 apply-argument optimization decision.

BUG=chromium:718820

Review-Url: https://codereview.chromium.org/2878343003
Cr-Commit-Position: refs/heads/master@{#45292}
---
 src/compiler/js-call-reducer.cc | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/compiler/js-call-reducer.cc b/src/compiler/js-call-reducer.cc
index 3a88a90c97..5e4a8f47a9 100644
--- a/src/compiler/js-call-reducer.cc
+++ b/src/compiler/js-call-reducer.cc
@@ -124,7 +124,14 @@ Reduction JSCallReducer::ReduceFunctionPrototypeApply(Node* node) {
     Node* arg_array = NodeProperties::GetValueInput(node, 3);
     if (arg_array->opcode() != IrOpcode::kJSCreateArguments) return NoChange();
     for (Edge edge : arg_array->use_edges()) {
-      if (edge.from()->opcode() == IrOpcode::kStateValues) continue;
+      Node* user = edge.from();
+      // Ignore uses as frame state's locals or parameters.
+      if (user->opcode() == IrOpcode::kStateValues) continue;
+      // Ignore uses as frame state's accumulator.
+      if (user->opcode() == IrOpcode::kFrameState &&
+          user->InputAt(2) == arg_array) {
+        continue;
+      }
       if (!NodeProperties::IsValueEdge(edge)) continue;
       if (edge.from() == node) continue;
       return NoChange();