Don't forget to subtract materialization instructions when computing the offset of the frame pointe…

runtime/vm/deopt_instructions.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/deopt_instructions.h"
 
 #include "vm/assembler.h"
 #include "vm/code_patcher.h"
 #include "vm/intermediate_language.h"
 #include "vm/locations.h"
@@ skipping 244 matching lines @@
   const bool objects_only = dest_frame_is_allocated_;
 
   // All kMaterializeObject instructions are emitted before the instructions
   // that describe stack frames. Skip them and defer materialization of
   // objects until the frame is fully reconstructed and it is safe to perform
   // GC.
   // Arguments (class of the instance to allocate and field-value pairs) are
   // described as part of the expression stack for the bottom-most deoptimized
   // frame. They will be used during materialization and removed from the stack
   // right before control switches to the unoptimized code.
-  const intptr_t num_materializations = len - frame_size;
+  const intptr_t num_materializations = deopt_info.NumMaterializations();
   PrepareForDeferredMaterialization(num_materializations);
   for (intptr_t from_index = 0, to_index = kDartFrameFixedSize;
        from_index < num_materializations;
        from_index++) {
     const intptr_t field_count =
         DeoptInstr::GetFieldCount(deopt_instructions[from_index]);
     intptr_t* args = GetDestFrameAddressAt(to_index);
     DeferredObject* obj = new DeferredObject(field_count, args);
     SetDeferredObjectAt(from_index, obj);
     to_index += obj->ArgumentCount();
@@ skipping 1139 matching lines @@
                           Smi* offset,
                           DeoptInfo* info,
                           Smi* reason) {
   intptr_t i = index * kEntrySize;
   *offset ^= table.At(i);
   *info ^= table.At(i + 1);
   *reason ^= table.At(i + 2);
 }
 
 }  // namespace dart