MIPS: Fix another bug in mozilla regress-396684.js

src/mips64/macro-assembler-mips64.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <limits.h>  // For LONG_MIN, LONG_MAX.
 
 #include "src/v8.h"
 
 #if V8_TARGET_ARCH_MIPS64
 
@@ skipping 3146 matching lines @@
   }
   jalr(at);
 
   // Emit a nop in the branch delay slot if required.
   if (bdslot == PROTECT)
     nop();
 }
 
 
 void MacroAssembler::DropAndRet(int drop) {
+  DCHECK(is_int16(drop * kPointerSize));
   Ret(USE_DELAY_SLOT);
   daddiu(sp, sp, drop * kPointerSize);
 }
 
 void MacroAssembler::DropAndRet(int drop,
                                 Condition cond,
                                 Register r1,
                                 const Operand& r2) {
   // Both Drop and Ret need to be conditional.
   Label skip;
@@ skipping 17 matching lines @@
   if (count <= 0) {
     return;
   }
 
   Label skip;
 
   if (cond != al) {
      Branch(&skip, NegateCondition(cond), reg, op);
   }
 
-  daddiu(sp, sp, count * kPointerSize);
+  Daddu(sp, sp, Operand(count * kPointerSize));
 
   if (cond != al) {
     bind(&skip);
   }
 }
 
 
 
 void MacroAssembler::Swap(Register reg1,
                           Register reg2,
@@ skipping 2915 matching lines @@
   }
   if (mag.shift > 0) sra(result, result, mag.shift);
   srl(at, dividend, 31);
   Addu(result, result, Operand(at));
 }
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_MIPS64