[turbofan] Fix loading of JSFunction from activation in case of adapter frame.

src/compiler/linkage-impl.h

Index: src/compiler/linkage-impl.h
diff --git a/src/compiler/linkage-impl.h b/src/compiler/linkage-impl.h
index 624d56aa977f3e51d3578900aa4b85659d2a1568..6655297c1054bfb57570e7e5951d698be97de85d 100644
--- a/src/compiler/linkage-impl.h
+++ b/src/compiler/linkage-impl.h
@@ -57,12 +57,8 @@ class LinkageHelper {
 
     // The target for JS function calls is the JSFunction object.
     MachineType target_type = kMachAnyTagged;
-    // Unoptimized code doesn't preserve the JSCallFunctionReg, so expect the
-    // closure on the stack.
-    LinkageLocation target_loc =
-        is_osr ? stackloc(Linkage::kJSFunctionCallClosureParamIndex -
-                          js_parameter_count)
-               : regloc(LinkageTraits::JSCallFunctionReg());
+    // TODO(titzer): JSFunction is in the frame, but not currently addressable.

[Michael Starzinger, 2015/03/25 14:27:37]

nit: IIUC this TODO only applies to OSR, for non-OSR it is totally fine to
always use the register and let the register allocator spill it for us. Can we
please add that to the sentence to avoid future confusion.

[titzer, 2015/03/25 16:12:05]

Done.

+    LinkageLocation target_loc = regloc(LinkageTraits::JSCallFunctionReg());
     return new (zone) CallDescriptor(     // --
         CallDescriptor::kCallJSFunction,  // kind
         target_type,                      // target MachineType