[turbofan] Fix wrong parameter indices in JSFrameSpecialization.

src/compiler/js-frame-specialization.cc

Index: src/compiler/js-frame-specialization.cc
diff --git a/src/compiler/js-frame-specialization.cc b/src/compiler/js-frame-specialization.cc
index 98b1827492545fd96a88a935cabfd33b6d8f36bd..6e4b0def567061b94ee4959282383923e766bba0 100644
--- a/src/compiler/js-frame-specialization.cc
+++ b/src/compiler/js-frame-specialization.cc
@@ -52,7 +52,10 @@ Reduction JSFrameSpecialization::ReduceParameter(Node* node) {
   if (index == Linkage::kJSFunctionCallClosureParamIndex) {
     object = frame()->function();
   } else if (index == parameters_count) {
-    // The Parameter index (arity + 1) is the context.
+    // The Parameter index (arity + 1) is the parameter count.
+    object = Smi::FromInt(parameters_count - 1);
+  } else if (index == parameters_count + 1) {
+    // The Parameter index (arity + 2) is the context.
     object = frame()->context();
   } else {
     // The Parameter index 0 is the receiver.