Fix assert/crash in HandlePolymorphicCallNamed

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 266c129d9bde65bf2b89966491ee46eb82327829..2b5b4c4f28fc8b87e8a846a613d93267ff672f26 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -6190,6 +6190,10 @@ void HOptimizedGraphBuilder::HandlePolymorphicCallNamed(
   // know about and do not want to handle ones we've never seen.  Otherwise
   // use a generic IC.
   if (ordered_functions == types->length() && FLAG_deoptimize_uncommon_cases) {
+    // Because the deopt may be the only path in the polymorphic call, make sure
+    // that the environment stack matches the depth on deopt that it otherwise
+    // would have had after a successful call.
+    Drop(argument_count - (ast_context()->IsEffect() ? 0 : 1));
     FinishExitWithHardDeoptimization(join);
   } else {
     HValue* context = environment()->LookupContext();