Fix JSObject::EnsureCanContainElements to correctly iterate over Arguments

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index bbbe45a350bd07d3fecbf54c71a2376d202a3e01..7408ce2e0e619fe69de11c491404c58a43968134 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -8755,7 +8755,12 @@ MaybeObject* JSReceiver::SetPrototype(Object* value,
 MaybeObject* JSObject::EnsureCanContainElements(Arguments* args,
                                                 uint32_t first_arg,
                                                 uint32_t arg_count) {
-  return EnsureCanContainElements(args->arguments() - first_arg, arg_count);
+  // Elements in |Arguments| are ordered backwards (because they're on the
+  // stack), but the method that's called here iterates over them in forward
+  // direction.
+  return EnsureCanContainElements(
+      args->arguments() - first_arg - (arg_count - 1),
+      arg_count);
 }