Bug 898047 - Fix Ion to set the Folded flag on arguments MIR when optimizing fun.apply(x, arguments). r=bhackett

js/src/ion/IonBuilder.cpp

@@ -4666,6 +4666,7 @@ IonBuilder::jsop_funapplyarguments(uint32_t argc)
 
         // Vp
         MPassArg *passVp = current->pop()->toPassArg();
+        passVp->getArgument()->setFoldedUnchecked();
         passVp->replaceAllUsesWith(passVp->getArgument());
         passVp->block()->discard(passVp);
 
@@ -4705,6 +4706,7 @@ IonBuilder::jsop_funapplyarguments(uint32_t argc)
 
     // Vp
     MPassArg *passVp = current->pop()->toPassArg();
+    passVp->getArgument()->setFoldedUnchecked();
     passVp->replaceAllUsesWith(passVp->getArgument());
     passVp->block()->discard(passVp);
 

js/src/jit-test/tests/ion/bug898047.js

@@ -0,0 +1,23 @@
+function g(aa) {
+    assertEq(aa, 123);
+}
+function f(x, yy) {
+    if (yy < 0) {
+	for (var j=0; j<100; j++) {}
+    }
+    var o = yy < 2000 ? o1 : o2;
+    o.fun.apply(22, arguments);
+}
+
+function test() {
+    o1 = {};
+    o1.fun = g;
+
+    o2 = {};
+    o2.x = 3;
+    o2.fun = g;
+
+    for (var i=0; i<3000; i++)
+	f(123, i);
+}
+test();