From 207ade7f3bcfaeb7316bb327119f8eb5d0deddaa Mon Sep 17 00:00:00 2001
From: Myles Borins <mborins@us.ibm.com>
Date: Mon, 27 Jun 2016 10:49:13 -0700
Subject: [PATCH] deps: backport 102e3e87e7 from V8 upstream

This commit backports a fix to a crankshaft bug affects arm64 systems.

Original commit message:

    [arm64] Fix jssp based spill slot accesses in Crankshaft

    Review URL: https://codereview.chromium.org/1401703003

    Cr-Commit-Position: refs/heads/master@{#31304}

Fixes: https://github.com/nodejs/node/issues/7417
PR-URL: https://github.com/nodejs/node/pull/7442
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 deps/v8/src/arm64/lithium-codegen-arm64.cc    |  2 ++
 .../regress/regress-arm64-spillslots.js       | 34 +++++++++++++++++++
 2 files changed, 36 insertions(+)
 create mode 100644 deps/v8/test/mjsunit/regress/regress-arm64-spillslots.js

diff --git a/deps/v8/src/arm64/lithium-codegen-arm64.cc b/deps/v8/src/arm64/lithium-codegen-arm64.cc
index 074926b83b7700..fb17397fd4db2e 100644
--- a/deps/v8/src/arm64/lithium-codegen-arm64.cc
+++ b/deps/v8/src/arm64/lithium-codegen-arm64.cc
@@ -2801,6 +2801,8 @@ void LCodeGen::DoDoubleToIntOrSmi(LDoubleToIntOrSmi* instr) {
 
 void LCodeGen::DoDrop(LDrop* instr) {
   __ Drop(instr->count());
+
+  RecordPushedArgumentsDelta(instr->hydrogen_value()->argument_delta());
 }
 
 
diff --git a/deps/v8/test/mjsunit/regress/regress-arm64-spillslots.js b/deps/v8/test/mjsunit/regress/regress-arm64-spillslots.js
new file mode 100644
index 00000000000000..1791b248431186
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-arm64-spillslots.js
@@ -0,0 +1,34 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+
+function Message(message) {
+  this.message = message;
+}
+
+function Inlined(input) {
+  var dummy = arguments[1] === undefined;
+  if (input instanceof Message) {
+    return input;
+  }
+  print("unreachable, but we must create register allocation complexity");
+  return [];
+}
+
+function Process(input) {
+  var ret = [];
+  ret.push(Inlined(input[0], 1, 2));
+  return ret;
+}
+
+var input = [new Message("TEST PASS")];
+
+Process(input);
+Process(input);
+%OptimizeFunctionOnNextCall(Process);
+var result = Process(input);
+assertEquals("TEST PASS", result[0].message);