VM: Fix slow-path deoptimization environment.

runtime/vm/flow_graph_compiler.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_XXX.
 
 #include "vm/flow_graph_compiler.h"
 
 #include "vm/bit_vector.h"
 #include "vm/cha.h"
@@ skipping 730 matching lines @@
 Environment* FlowGraphCompiler::SlowPathEnvironmentFor(
     Instruction* instruction) {
   if (instruction->env() == NULL) {
     ASSERT(!is_optimizing());
     return NULL;
   }
 
   Environment* env = instruction->env()->DeepCopy(isolate());
   // 1. Iterate the registers in the order they will be spilled to compute
   //    the slots they will be spilled to.
-  intptr_t next_slot = StackSize();
+  intptr_t next_slot = StackSize() + env->CountArgsPushed();
   RegisterSet* regs = instruction->locs()->live_registers();
   intptr_t fpu_reg_slots[kNumberOfFpuRegisters];
   intptr_t cpu_reg_slots[kNumberOfCpuRegisters];
   const intptr_t kFpuRegisterSpillFactor = kFpuRegisterSize / kWordSize;
   // FPU registers are spilled first from highest to lowest register number.
   for (intptr_t i = kNumberOfFpuRegisters - 1; i >= 0; --i) {
     FpuRegister reg = static_cast<FpuRegister>(i);
     if (regs->ContainsFpuRegister(reg)) {
       // We use the lowest address (thus highest index) to identify a
       // multi-word spill slot.
@@ skipping 826 matching lines @@
   const Array& res = Array::Handle(
       Array::New(inline_id_to_function_.length(), Heap::kOld));
   for (intptr_t i = 0; i < inline_id_to_function_.length(); i++) {
     res.SetAt(i, *inline_id_to_function_[i]);
   }
   return res.raw();
 }
 
 
 }  // namespace dart