[maglev] Fix VirtualObject refactoring

- VirtualObject::slot_count does not include the Map. We need to add +1
when the map count should be included.

- We forgot to patch the nested allocations back to the object
graph.

Fixed: 346042378
Change-Id: I54e06a82a9324a55902b720e8188b6b8ec2c22bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5614730
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94341}

src/maglev/maglev-code-generator.cc

@@ -1375,7 +1375,7 @@ class MaglevFrameTranslationBuilder {
                                    object->double_elements());
     }
     DCHECK_EQ(object->type(), VirtualObject::kDefault);
-    translation_array_builder_->BeginCapturedObject(object->slot_count());
+    translation_array_builder_->BeginCapturedObject(object->slot_count() + 1);
     translation_array_builder_->StoreLiteral(
         GetDeoptLiteral(*object->map().object()));
     for (uint32_t i = 0; i < object->slot_count(); i++) {

src/maglev/maglev-graph-builder.cc

@@ -8659,6 +8659,22 @@ ReduceResult MaglevGraphBuilder::ReduceCallWithArrayLikeForArgumentsObject(
     return ReduceCall(target_node, new_args);
   }
 
+  if (Constant* constant_value = elements_value->TryCast<Constant>()) {
+    DCHECK(constant_value->object().IsFixedArray());
+    compiler::FixedArrayRef elements = constant_value->object().AsFixedArray();
+    base::SmallVector<ValueNode*, 8> arg_list;
+    DCHECK_NOT_NULL(args.receiver());
+    arg_list.push_back(args.receiver());
+    for (int i = 0; i < static_cast<int>(args.count()); i++) {
+      arg_list.push_back(args[i]);
+    }
+    for (int i = 0; i < elements.length(); i++) {
+      arg_list.push_back(GetConstant(*elements.TryGet(broker(), i)));
+    }
+    CallArguments new_args(ConvertReceiverMode::kAny, std::move(arg_list));
+    return ReduceCall(target_node, new_args);
+  }
+
   DCHECK(elements_value->Is<InlinedAllocation>());
   InlinedAllocation* allocation = elements_value->Cast<InlinedAllocation>();
   VirtualObject* elements = allocation->object();
@@ -10589,6 +10605,7 @@ void MaglevGraphBuilder::AddNonEscapingUses(InlinedAllocation* allocation,
 }
 
 void MaglevGraphBuilder::AddDeoptUse(VirtualObject* vobject) {
+  if (vobject->type() != VirtualObject::kDefault) return;
   for (uint32_t i = 0; i < vobject->slot_count(); i++) {
     ValueNode* value = vobject->get_by_index(i);
     if (!IsConstantNode(value->opcode()) &&
@@ -10648,6 +10665,7 @@ ValueNode* MaglevGraphBuilder::BuildInlinedAllocation(
     if (node->Is<VirtualObject>()) {
       VirtualObject* nested = node->Cast<VirtualObject>();
       node = BuildInlinedAllocation(nested, allocation_type);
+      vobject->set_by_index(i, node);
     } else if (node->Is<Float64Constant>()) {
       node = BuildInlinedAllocationForHeapNumber(
           CreateHeapNumber(node->Cast<Float64Constant>()->value()),
@@ -10659,7 +10677,7 @@ ValueNode* MaglevGraphBuilder::BuildInlinedAllocation(
   }
   InlinedAllocation* allocation =
       ExtendOrReallocateCurrentAllocationBlock(allocation_type, vobject);
-  AddNonEscapingUses(allocation, vobject->slot_count());
+  AddNonEscapingUses(allocation, vobject->slot_count() + 1);
   BuildStoreMap(allocation, vobject->map(),
                 StoreMap::initializing_kind(allocation_type));
   for (uint32_t i = 0; i < vobject->slot_count(); i++) {

src/maglev/maglev-ir.h

@@ -4991,6 +4991,11 @@ class VirtualObject : public FixedInputValueNodeT<0, VirtualObject> {
     return slots_.data[i];
   }
 
+  void set_by_index(uint32_t i, ValueNode* value) {
+    DCHECK_EQ(type_, kDefault);
+    slots_.data[i] = value;
+  }
+
   void set(uint32_t offset, ValueNode* value) {
     DCHECK_NE(offset, 0);  // Don't try to set the map through this setter.
     DCHECK_EQ(type_, kDefault);