[turbofan] Fix wrong parameter indices in JSFrameSpecialization.

src/compiler/js-frame-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-frame-specialization.h"
 
 #include "src/compiler/js-graph.h"
 #include "src/compiler/linkage.h"
 #include "src/frames-inl.h"
 
@@ skipping 34 matching lines @@
 
 Reduction JSFrameSpecialization::ReduceParameter(Node* node) {
   DCHECK_EQ(IrOpcode::kParameter, node->opcode());
   DisallowHeapAllocation no_gc;
   Object* object;
   int const index = ParameterIndexOf(node->op());
   int const parameters_count = frame()->ComputeParametersCount() + 1;
   if (index == Linkage::kJSFunctionCallClosureParamIndex) {
     object = frame()->function();
   } else if (index == parameters_count) {
-    // The Parameter index (arity + 1) is the context.
+    // The Parameter index (arity + 1) is the parameter count.
+    object = Smi::FromInt(parameters_count - 1);
+  } else if (index == parameters_count + 1) {
+    // The Parameter index (arity + 2) is the context.
     object = frame()->context();
   } else {
     // The Parameter index 0 is the receiver.
     object = index ? frame()->GetParameter(index - 1) : frame()->receiver();
   }
   return Replace(jsgraph()->Constant(handle(object, isolate())));
 }
 
 
 Isolate* JSFrameSpecialization::isolate() const { return jsgraph()->isolate(); }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8