[deoptimizer] Fix define typo and inlined frame base

Change-Id: I81ace5b6abf883c80bea1fada94a66888b16745a
Bug: chromium:1144672, v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2512923Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70971}

src/deoptimizer/deoptimizer.cc

@@ -3464,12 +3464,12 @@ TranslatedState::TranslatedState(const JavaScriptFrame* frame) {
   DCHECK(!data.is_null() && deopt_index != Safepoint::kNoDeoptimizationIndex);
   TranslationIterator it(data.TranslationByteArray(),
                          data.TranslationIndex(deopt_index).value());
-#ifdef V8_NO_ARGUMENT_ADAPTOR
+#ifdef V8_NO_ARGUMENTS_ADAPTOR
   int actual_argc = frame->GetActualArgumentCount();
 #else
   int actual_argc = 0;
 #endif
-  Init(frame->isolate(), frame->fp(), kNullAddress, &it, data.LiteralArray(),
+  Init(frame->isolate(), frame->fp(), frame->fp(), &it, data.LiteralArray(),
        nullptr /* registers */, nullptr /* trace file */,
        frame->function().shared().internal_formal_parameter_count(),
        actual_argc);

test/mjsunit/regress/regress-1144672.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function g(b) {
+  const _ = Object.getOwnPropertyDescriptors(g);
+  // for (const _ of b) {}
+}
+
+function f(...a) {
+  g(a);
+}
+
+%PrepareFunctionForOptimization(f);
+%PrepareFunctionForOptimization(g);
+f([]);
+%OptimizeFunctionOnNextCall(f);
+f([]);