ARM64: Fix stack manipulation.

test/mjsunit/regress/regress-crbug-425585.js

Index: test/mjsunit/regress/regress-crbug-425585.js
diff --git a/test/mjsunit/regress/comparison-in-effect-context-deopt.js b/test/mjsunit/regress/regress-crbug-425585.js
similarity index 76%
copy from test/mjsunit/regress/comparison-in-effect-context-deopt.js
copy to test/mjsunit/regress/regress-crbug-425585.js
index b28dff73a745dfc7445a6c093380c56f51b3fb76..c27febba790148008834ea1c563f7fae11b042ef 100644
--- a/test/mjsunit/regress/comparison-in-effect-context-deopt.js
+++ b/test/mjsunit/regress/regress-crbug-425585.js
@@ -25,23 +25,24 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
 
-function lazyDeopt() {
-  %DeoptimizeFunction(test);
-  return "deopt";
-}
-
-var x = { toString : lazyDeopt };
+var correct_result = "This is the correct result.";
 
-function g(x) {
-  return "result";
+function foo(recursion_depth) {
+   if (recursion_depth > 0) return foo(recursion_depth - 1);
+   return new String(correct_result, 1, 2, 3, 4, 5, 6);
 }
 
-function test(x) {
-  return g(void(x == ""));
+// Roll our own non-strict assertEquals replacement.
+function test(i) {
+   var actual = foo(i);
+   if (correct_result != actual) {
+     var msg = "Expected \"" + correct_result + "\", found " + actual;
+     throw new MjsUnitAssertionError(msg);
+   }
 }
 
-test(x);
-%OptimizeFunctionOnNextCall(test);
-assertEquals("result", test(x));
+test(1);
+test(1);
+test(10);
+test(100);