Fix an overflow in on-stack replacement spill-slot allocation for Crankshaft.

src/compiler.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 195 matching lines @@
     return true;
   }
 
   // Due to an encoding limit on LUnallocated operands in the Lithium
   // language, we cannot optimize functions with too many formal parameters
   // or perform on-stack replacement for function with too many
   // stack-allocated local variables.
   //
   // The encoding is as a signed value, with parameters and receiver using
   // the negative indices and locals the non-negative ones.
-  const int parameter_limit = (LUnallocated::kMaxFixedIndices / 2);
-  const int locals_limit = parameter_limit - 1;
+  const int parameter_limit = -LUnallocated::kMinFixedIndex;
+  const int locals_limit = LUnallocated::kMaxFixedIndex;
   Scope* scope = info->scope();
   if ((scope->num_parameters() + 1) > parameter_limit ||
       scope->num_stack_slots() > locals_limit) {
     info->AbortOptimization();
     Handle<JSFunction> closure = info->closure();
     info->shared_info()->DisableOptimization(*closure);
     // True indicates the compilation pipeline is still going, not
     // necessarily that we optimized the code.
     return true;
   }
@@ skipping 556 matching lines @@
                               shared->DebugName()));
     }
   }
 
   GDBJIT(AddCode(Handle<String>(shared->DebugName()),
                  Handle<Script>(info->script()),
                  Handle<Code>(info->code())));
 }
 
 } }  // namespace v8::internal