[turbofan] Further fixing ES6 tail call elimination in Turbofan.

src/ia32/macro-assembler-ia32.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_IA32
 
 #include "src/base/bits.h"
 #include "src/base/division-by-constant.h"
 #include "src/bootstrapper.h"
 #include "src/codegen.h"
@@ skipping 2068 matching lines @@
 }
 
 
 void MacroAssembler::JumpToExternalReference(const ExternalReference& ext) {
   // Set the entry point and jump to the C entry runtime stub.
   mov(ebx, Immediate(ext));
   CEntryStub ces(isolate(), 1);
   jmp(ces.GetCode(), RelocInfo::CODE_TARGET);
 }
 
-void MacroAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
-                                        Register caller_args_count_reg,
-                                        Register scratch0, Register scratch1,
-                                        ReturnAddressState ra_state) {
+void MacroAssembler::PrepareForTailCall(
+    const ParameterCount& callee_args_count, Register caller_args_count_reg,
+    Register scratch0, Register scratch1, ReturnAddressState ra_state,
+    int number_of_temp_values_after_return_address) {
 #if DEBUG
   if (callee_args_count.is_reg()) {
     DCHECK(!AreAliased(callee_args_count.reg(), caller_args_count_reg, scratch0,
                        scratch1));
   } else {
     DCHECK(!AreAliased(caller_args_count_reg, scratch0, scratch1));
   }
+  DCHECK(ra_state != ReturnAddressState::kNotOnStack ||
+         number_of_temp_values_after_return_address == 0);
 #endif
 
   // Calculate the destination address where we will put the return address
   // after we drop current frame.
   Register new_sp_reg = scratch0;
   if (callee_args_count.is_reg()) {
     sub(caller_args_count_reg, callee_args_count.reg());
-    lea(new_sp_reg, Operand(ebp, caller_args_count_reg, times_pointer_size,
-                            StandardFrameConstants::kCallerPCOffset));
+    lea(new_sp_reg,
+        Operand(ebp, caller_args_count_reg, times_pointer_size,
+                StandardFrameConstants::kCallerPCOffset -
+                    number_of_temp_values_after_return_address * kPointerSize));
   } else {
     lea(new_sp_reg, Operand(ebp, caller_args_count_reg, times_pointer_size,
                             StandardFrameConstants::kCallerPCOffset -
-                                callee_args_count.immediate() * kPointerSize));
+                                (callee_args_count.immediate() +
+                                 number_of_temp_values_after_return_address) *
+                                    kPointerSize));
   }
 
   if (FLAG_debug_code) {
     cmp(esp, new_sp_reg);
     Check(below, kStackAccessBelowStackPointer);
   }
 
   // Copy return address from caller's frame to current frame's return address
   // to avoid its trashing and let the following loop copy it to the right
   // place.
   Register tmp_reg = scratch1;
   if (ra_state == ReturnAddressState::kOnStack) {
     mov(tmp_reg, Operand(ebp, StandardFrameConstants::kCallerPCOffset));
-    mov(Operand(esp, 0), tmp_reg);
+    mov(Operand(esp, number_of_temp_values_after_return_address * kPointerSize),
+        tmp_reg);
   } else {
     DCHECK(ReturnAddressState::kNotOnStack == ra_state);
+    DCHECK_EQ(0, number_of_temp_values_after_return_address);
     Push(Operand(ebp, StandardFrameConstants::kCallerPCOffset));
   }
 
   // Restore caller's frame pointer now as it could be overwritten by
   // the copying loop.
   mov(ebp, Operand(ebp, StandardFrameConstants::kCallerFPOffset));
 
   // +2 here is to copy both receiver and return address.
   Register count_reg = caller_args_count_reg;
   if (callee_args_count.is_reg()) {
-    lea(count_reg, Operand(callee_args_count.reg(), 2));
+    lea(count_reg, Operand(callee_args_count.reg(),
+                           2 + number_of_temp_values_after_return_address));
   } else {
-    mov(count_reg, Immediate(callee_args_count.immediate() + 2));
+    mov(count_reg, Immediate(callee_args_count.immediate() + 2 +
+                             number_of_temp_values_after_return_address));
     // TODO(ishell): Unroll copying loop for small immediate values.
   }
 
   // Now copy callee arguments to the caller frame going backwards to avoid
   // callee arguments corruption (source and destination areas could overlap).
   Label loop, entry;
   jmp(&entry, Label::kNear);
   bind(&loop);
   dec(count_reg);
   mov(tmp_reg, Operand(esp, count_reg, times_pointer_size, 0));
@@ skipping 1149 matching lines @@
   mov(eax, dividend);
   shr(eax, 31);
   add(edx, eax);
 }
 
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_IA32