Pass in the expected number of arguments to a bailout method.

lib/compiler/implementation/ssa/codegen.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 class SsaCodeGeneratorTask extends CompilerTask {
   final JavaScriptBackend backend;
   SsaCodeGeneratorTask(JavaScriptBackend backend)
       : this.backend = backend,
         super(backend.compiler);
   String get name() => 'SSA code generator';
@@ skipping 2171 matching lines @@
     } else {
       use(node.checkedInput, expectedPrecedence);
     }
   }
 }
 
 class SsaOptimizedCodeGenerator extends SsaCodeGenerator {
   SsaOptimizedCodeGenerator(backend, work, parameters, parameterNames)
     : super(backend, work, parameters, parameterNames);
 
+  int maxBailoutParameters;
+
   void beginGraph(HGraph graph) {}
   void endGraph(HGraph graph) {}
 
   void bailout(HTypeGuard guard, String reason) {
+    if (maxBailoutParameters === null) {
+      maxBailoutParameters = 0;
+      work.guards.forEach((HTypeGuard guard) {
+        int inputLength = guard.inputs.length;
+        if (inputLength > maxBailoutParameters) {
+          maxBailoutParameters = inputLength;
+        }
+      });
+    }
     HInstruction input = guard.guarded;
     Namer namer = compiler.namer;
     Element element = work.element;
     buffer.add('return ');
     if (element.isInstanceMember()) {
       // TODO(ngeoffray): This does not work in case we come from a
       // super call. We must make bailout names unique.
       buffer.add('this.${namer.getBailoutName(element)}');
     } else {
       buffer.add(namer.isolateBailoutAccess(element));
     }
     int parametersCount = parameterNames.length;
     buffer.add('($parameters');
     if (parametersCount != 0) buffer.add(', ');
-    if (guard.guarded is !HParameterValue) {
-      buffer.add('${guard.state}');
-      bool first = true;
-      // TODO(ngeoffray): if the bailout method takes more arguments,
-      // fill the remaining arguments with undefined.
-      // TODO(ngeoffray): try to put a variable at a deterministic
-      // location, so that multiple bailout calls put the variable at
-      // the same parameter index.
-      for (int i = 0; i < guard.inputs.length; i++) {
-        buffer.add(', ');
-        use(guard.inputs[i], JSPrecedence.ASSIGNMENT_PRECEDENCE);
-      }
-    } else {
-      assert(guard.guarded is HParameterValue);
-      buffer.add(' 0');
+    buffer.add('${guard.state}');
+    // TODO(ngeoffray): try to put a variable at a deterministic
+    // location, so that multiple bailout calls put the variable at
+    // the same parameter index.
+    int i = 0;
+    for (; i < guard.inputs.length; i++) {
+      buffer.add(', ');
+      use(guard.inputs[i], JSPrecedence.ASSIGNMENT_PRECEDENCE);
+    }
+    // Make sure we call the bailout method with the number of
+    // arguments it expects. This avoids having the underlying
+    // JS engine fill them in for us.
+    for (; i < maxBailoutParameters; i++) {
+      buffer.add(', 0');
     }
     buffer.add(')');
   }
 
   void visitTypeGuard(HTypeGuard node) {
     addIndentation();
     HInstruction input = node.guarded;
     if (node.isInteger()) {
       buffer.add('if (');
       checkInt(input, '!==');
@@ skipping 336 matching lines @@
       startBailoutSwitch();
     }
   }
 
   void endLabeledBlock(HLabeledBlockInformation labeledBlockInfo) {
     if (labeledBlockInfo.body.start.hasGuards()) {
       endBailoutSwitch();
     }
   }
 }