[turbofan] Fully reduce node in JSCallReducer::ReduceSpreadCall.

When turning a JSCallWithSpread into a JSCall or a JSConstructWithSpread
into a JSConstruct, we need to (manually) invoke the JSCallReducer logic
again on the changed node to make sure that optimizations that are now
possible for the JSCall or JSConstruct operator are properly applied.

BUG=v8:5932,v8:5895,v8:6344,v8:6399,v8:6400
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2882153003
Cr-Commit-Position: refs/heads/master@{#45325}
This commit is contained in:
bmeurer 2017-05-16 02:02:07 -07:00 committed by Commit bot
parent cd33ec5542
commit 724d8dfe93

View File

@ -506,10 +506,13 @@ Reduction JSCallReducer::ReduceSpreadCall(Node* node, int arity) {
// through here.
if (node->opcode() == IrOpcode::kJSCallWithSpread) {
NodeProperties::ChangeOp(node, javascript()->Call(arity + 1));
Reduction const r = ReduceJSCall(node);
return r.Changed() ? r : Changed(node);
} else {
NodeProperties::ChangeOp(node, javascript()->Construct(arity + 2));
Reduction const r = ReduceJSConstruct(node);
return r.Changed() ? r : Changed(node);
}
return Changed(node);
}
namespace {