Merged r19676 into 3.24 branch.

src/deoptimizer.cc

Index: src/deoptimizer.cc
diff --git a/src/deoptimizer.cc b/src/deoptimizer.cc
index 85e20d977a700467d9abd95939281e6b349f71ea..18be014c142e364af3f357506148c2f267eaa6b6 100644
--- a/src/deoptimizer.cc
+++ b/src/deoptimizer.cc
@@ -1750,7 +1750,11 @@ Handle<Object> Deoptimizer::MaterializeNextHeapObject() {
     Handle<JSObject> arguments = Handle<JSObject>::cast(
         Accessors::FunctionGetArguments(function));
     materialized_objects_->Add(arguments);
-    materialization_value_index_ += length;
+    // To keep consistent object counters, we still materialize the
+    // nested values (but we throw them away).
+    for (int i = 0; i < length; ++i) {
+      MaterializeNextValue();
+    }
   } else if (desc.is_arguments()) {
     // Construct an arguments object and copy the parameters to a newly
     // allocated arguments object backing store.