MIPS: Fix bug in allocation stub's slow path.

runtime/vm/stub_code_mips.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"
 #if defined(TARGET_ARCH_MIPS)
 
 #include "vm/assembler.h"
 #include "vm/code_generator.h"
 #include "vm/compiler.h"
@@ skipping 1378 matching lines @@
     __ lw(T1, Address(SP, 0 * kWordSize));
   }
   __ Bind(&slow_case_with_type_arguments);
   // If is_cls_parameterized:
   // T1: new object type arguments (instantiated or not).
   // Create a stub frame as we are pushing some objects on the stack before
   // calling into the runtime.
   __ EnterStubFrame(true);  // Uses pool pointer to pass cls to runtime.
   __ LoadObject(TMP, cls);
 
-  __ addiu(SP, SP, Immediate(-4 * kWordSize));
+  __ addiu(SP, SP, Immediate(-3 * kWordSize));
   // Space on stack for return value.
   __ LoadImmediate(T7, reinterpret_cast<intptr_t>(Object::null()));
   __ sw(T7, Address(SP, 2 * kWordSize));
   __ sw(TMP, Address(SP, 1 * kWordSize));  // Class of object to be allocated.
 
   if (is_cls_parameterized) {
     // Push type arguments of object to be allocated and of instantiator.
     __ sw(T1, Address(SP, 0 * kWordSize));
   } else {
     // Push null type arguments.
@@ skipping 978 matching lines @@
   const Register right = T0;
   __ lw(left, Address(SP, 1 * kWordSize));
   __ lw(right, Address(SP, 0 * kWordSize));
   GenerateIdenticalWithNumberCheckStub(assembler, left, right, temp1, temp2);
   __ Ret();
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_MIPS