[Builtins] New Array.prototype.filter implementation observability bug.

src/interface-descriptors.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_CALL_INTERFACE_DESCRIPTOR_H_
 #define V8_CALL_INTERFACE_DESCRIPTOR_H_
 
 #include <memory>
 
 #include "src/assembler.h"
@@ skipping 702 matching lines @@
 class IteratingArrayBuiltinDescriptor : public BuiltinDescriptor {
  public:
   DEFINE_BUILTIN_PARAMETERS(kCallback, kThisArg)
   DECLARE_BUILTIN_DESCRIPTOR(IteratingArrayBuiltinDescriptor)
 };
 
 class IteratingArrayBuiltinLoopContinuationDescriptor
     : public BuiltinDescriptor {
  public:
   DEFINE_BUILTIN_PARAMETERS(kCallback, kThisArg, kArray, kObject, kInitialK,
-                            kLength)
+                            kLength, kTo)
   DECLARE_BUILTIN_DESCRIPTOR(IteratingArrayBuiltinLoopContinuationDescriptor)
 };
 
 class ArrayConstructorDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kTarget, kNewTarget, kActualArgumentsCount, kAllocationSite)
   DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(ArrayConstructorDescriptor,
                                                CallInterfaceDescriptor)
 };
 
@@ skipping 263 matching lines @@
 }  // namespace v8
 
 
 #if V8_TARGET_ARCH_ARM64
 #include "src/arm64/interface-descriptors-arm64.h"
 #elif V8_TARGET_ARCH_ARM
 #include "src/arm/interface-descriptors-arm.h"
 #endif
 
 #endif  // V8_CALL_INTERFACE_DESCRIPTOR_H_