[builtins] Fix MathMaxMin on arm and arm64

src/arm64/builtins-arm64.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_ARM64
 
 #include "src/arm64/frames-arm64.h"
 #include "src/codegen.h"
 #include "src/debug/debug.h"
 #include "src/deoptimizer.h"
@@ skipping 106 matching lines @@
   __ LoadRoot(x2, Heap::kUndefinedValueRootIndex);
   __ Mov(x3, x1);
   ArrayConstructorStub stub(masm->isolate());
   __ TailCallStub(&stub);
 }
 
 
 // static
 void Builtins::Generate_MathMaxMin(MacroAssembler* masm, MathMaxMinKind kind) {
   // ----------- S t a t e -------------
-  //  -- x0                 : number of arguments
-  //  -- x1                 : function
-  //  -- cp                 : context
-  //  -- lr                 : return address
-  //  -- sp[(argc - n) * 8] : arg[n] (zero-based)
-  //  -- sp[(argc + 1) * 8] : receiver
+  //  -- x0                     : number of arguments
+  //  -- x1                     : function
+  //  -- cp                     : context
+  //  -- lr                     : return address
+  //  -- sp[(argc - n - 1) * 8] : arg[n] (zero-based)
+  //  -- sp[argc * 8]           : receiver
   // -----------------------------------
   ASM_LOCATION("Builtins::Generate_MathMaxMin");
 
   Heap::RootListIndex const root_index =
       (kind == MathMaxMinKind::kMin) ? Heap::kInfinityValueRootIndex
                                      : Heap::kMinusInfinityValueRootIndex;
 
   // Load the accumulator with the default return value (either -Infinity or
   // +Infinity), with the tagged value in x5 and the double value in d5.
   __ LoadRoot(x5, root_index);
   __ Ldr(d5, FieldMemOperand(x5, HeapNumber::kValueOffset));
 
-  // Remember how many slots to drop (including the receiver).
-  __ Add(x4, x0, 1);
-
   Label done_loop, loop;
+  __ mov(x4, x0);
   __ Bind(&loop);
   {
     // Check if all parameters done.
-    __ Subs(x0, x0, 1);
+    __ Subs(x4, x4, 1);
     __ B(lt, &done_loop);
 
     // Load the next parameter tagged value into x2.
-    __ Peek(x2, Operand(x0, LSL, kPointerSizeLog2));
+    __ Peek(x2, Operand(x4, LSL, kPointerSizeLog2));
 
     // Load the double value of the parameter into d2, maybe converting the
     // parameter to a number first using the ToNumber builtin if necessary.
     Label convert_smi, convert_number, done_convert;
     __ JumpIfSmi(x2, &convert_smi);
     __ JumpIfHeapNumber(x2, &convert_number);
     {
       // Parameter is not a Number, use the ToNumber builtin to convert it.
       FrameScope scope(masm, StackFrame::MANUAL);
       __ Push(lr, fp);
@@ skipping 38 matching lines @@
       DCHECK(kind == MathMaxMinKind::kMax);
       __ Fmax(d5, d5, d2);
     }
     __ Fmov(x10, d5);
     __ Cmp(x10, x11);
     __ Csel(x5, x5, x2, eq);
     __ B(&loop);
   }
 
   __ Bind(&done_loop);
-  __ Drop(x4);
+  // Drop all slots, including the receiver.
+  __ Add(x0, x0, 1);
+  __ Drop(x0);
   __ Mov(x0, x5);
   __ Ret();
 }
 
 // static
 void Builtins::Generate_NumberConstructor(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- x0                     : number of arguments
   //  -- x1                     : constructor function
   //  -- lr                     : return address
@@ skipping 2775 matching lines @@
   }
 }
 
 
 #undef __
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_ARM