Always iterate outgoing arguments as a part of caller frame.

src/runtime.cc

Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index ff9f914c4896e917c14fafec5532a32f2a136d0e..f486a2ed20f8bad9888095a8926916debbb82614 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -7323,14 +7323,15 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_NotifyDeoptimized) {
   ASSERT(isolate->heap()->IsAllocationAllowed());
   int frames = deoptimizer->output_count();
 
+  deoptimizer->MaterializeHeapNumbers();
+  delete deoptimizer;
+
   JavaScriptFrameIterator it(isolate);
   JavaScriptFrame* frame = NULL;
   for (int i = 0; i < frames; i++) {

[fschneider, 2011/04/06 14:06:55]

That's a little confusing to get to the bottom frame of the deopt. Can you just
write e.g.:

for (int i = 0; i < frames - 1; i++) it.Advance();

     if (i != 0) it.Advance();
-    frame = it.frame();
-    deoptimizer->InsertHeapNumberValues(frames - i - 1, frame);
   }
-  delete deoptimizer;
+  frame = it.frame();
 
   RUNTIME_ASSERT(frame->function()->IsJSFunction());
   Handle<JSFunction> function(JSFunction::cast(frame->function()), isolate);