Fix off-by-one error in AstTyper, part 2.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/112933002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18308 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/typing.h

@@ -83,8 +83,11 @@ class AstTyper: public AstVisitor {
   void ExitEffects() { store_ = store_.Pop(); }
 
   int variable_index(Variable* var) {
+    // Stack locals have the range [0 .. l]
+    // Parameters have the range [-1 .. p]
+    // We map this to [-p-2 .. -1, 0 .. l]
     return var->IsStackLocal() ? var->index() :
-           var->IsParameter() ? -var->index() - 1 : kNoVar;
+           var->IsParameter() ? -var->index() - 2 : kNoVar;
   }
 
   void VisitDeclarations(ZoneList<Declaration*>* declarations);

test/mjsunit/regress/regress-param-local-type.js

@@ -42,3 +42,17 @@ f(1);
 %OptimizeFunctionOnNextCall(f);
 f(1);
 assertOptimized(f);
+
+
+function g() {  // 0th parameter (receiver) is tagged.
+  var s = '';   // First local has string type.
+  var n = 0;
+  var i = 1;
+  n = i + this;
+}
+
+g.call(1);
+g.call(1);
+%OptimizeFunctionOnNextCall(g);
+g.call(1);
+assertOptimized(g);