StubCallInterfaceDescriptor takes a context register.

src/deoptimizer.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
 #include "src/codegen.h"
 #include "src/deoptimizer.h"
 #include "src/disasm.h"
@@ skipping 1536 matching lines @@
   //
 
   CHECK(compiled_code_->is_hydrogen_stub());
   int major_key = compiled_code_->major_key();
   CodeStubInterfaceDescriptor* descriptor =
       isolate_->code_stub_interface_descriptor(major_key);
 
   // The output frame must have room for all pushed register parameters
   // and the standard stack frame slots.  Include space for an argument
   // object to the callee and optionally the space to pass the argument
-  // object to the stub failure handler.
-  CHECK_GE(descriptor->register_param_count(), 0);
-  int height_in_bytes = kPointerSize * descriptor->register_param_count() +
-      sizeof(Arguments) + kPointerSize;
+  // object to the stub failure handler. The descriptor's first register
+  // parameter is the context register, which we deal with separately.
+  int param_count = descriptor->register_param_count() - 1;

[danno, 2014/07/16 13:19:59]

Use GetEnvironmentParameterLength(), then comment is unnecessary

[mvstanton, 2014/07/17 09:04:05]

Done.

+  CHECK_GE(param_count, 0);
+
+  int height_in_bytes = kPointerSize * param_count + sizeof(Arguments) +
+      kPointerSize;
   int fixed_frame_size = StandardFrameConstants::kFixedFrameSize;
   int input_frame_size = input_->GetFrameSize();
   int output_frame_size = height_in_bytes + fixed_frame_size;
   if (trace_scope_ != NULL) {
     PrintF(trace_scope_->file(),
            "  translating %s => StubFailureTrampolineStub, height=%d\n",
            CodeStub::MajorName(static_cast<CodeStub::Major>(major_key), false),
            height_in_bytes);
   }
 
@@ skipping 121 matching lines @@
   output_frame->SetFrameSlot(output_frame_offset, value);
   if (trace_scope_ != NULL) {
     PrintF(trace_scope_->file(),
            "    0x%08" V8PRIxPTR ": [top + %d] <- 0x%08"
            V8PRIxPTR " ; args*\n",
            top_address + output_frame_offset, output_frame_offset, value);
   }
 
   // Copy the register parameters to the failure frame.
   int arguments_length_offset = -1;
-  for (int i = 0; i < descriptor->register_param_count(); ++i) {
+  for (int i = 0; i < param_count; ++i) {
     output_frame_offset -= kPointerSize;
     DoTranslateCommand(iterator, 0, output_frame_offset);
 
-    if (!arg_count_known && descriptor->IsParameterCountRegister(i)) {
+    // In the frame we only have descriptor->ParameterRegisters [1..param_count]
+    // because we don't include the context register. Adjust our index into
+    // the descriptor parameter array accordingly.

[danno, 2014/07/16 13:19:59]

Why not move this up to the loop iteration? e.g.

for (int i = 1; i < param_count; ++i) {

Otherwise, I think you might actually do one too many iterations here, since you
access param_count + 1, which is technically OOB

[mvstanton, 2014/07/17 09:04:05]

Well, I would have to make the terminating condition "i <= param_count", because
param count runs from [0, param_count] but the index in the descriptor runs from
[1, param_count+1] since we have to skip over the context register. I thought
about that and decided to keep the loop condition simple, and the complexity in
this notion that I need to translate to a descriptor parameter register. 

So I'd prefer to leave it this way, but I could go from 1 <= i <= param_count
too, let me know.

<EDIT>

On second thought, what a complex mess. I just introduced method
IsEnvironmentParameterCountRegister() which makes things simpler.

+    if (!arg_count_known && descriptor->IsParameterCountRegister(i + 1)) {
       arguments_length_offset = output_frame_offset;
     }
   }
 
   CHECK_EQ(output_frame_offset, 0);
 
   if (!arg_count_known) {
     CHECK_GE(arguments_length_offset, 0);
     // We know it's a smi because 1) the code stub guarantees the stack
     // parameter count is in smi range, and 2) the DoTranslateCommand in the
@@ skipping 1868 matching lines @@
 }
 
 
 void DeoptimizedFrameInfo::Iterate(ObjectVisitor* v) {
   v->VisitPointer(BitCast<Object**>(&function_));
   v->VisitPointers(parameters_, parameters_ + parameters_count_);
   v->VisitPointers(expression_stack_, expression_stack_ + expression_count_);
 }
 
 } }  // namespace v8::internal