PPC/s390: [builtins] Fix MathMaxMin on arm and arm64

Port b86ac0e0

Original commit message:

    Both of these were broken in different ways:
    * On arm, the loop counter was passed as argc on the stack.
    * On arm64, we passed argc + 1 instead of argc.

    The result in both cases was an incorrect receiver for the builtin frame
    when generating stack traces.

R=jgruber@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=v8:4815
LOG=N

Review-Url: https://codereview.chromium.org/2125913004
Cr-Commit-Position: refs/heads/master@{#37567}

src/ppc/builtins-ppc.cc

@@ -130,8 +130,8 @@ void Builtins::Generate_MathMaxMin(MacroAssembler* masm, MathMaxMinKind kind) {
   //  -- r4                     : function
   //  -- cp                     : context
   //  -- lr                     : return address
-  //  -- sp[(argc - n) * 8] : arg[n] (zero-based)
-  //  -- sp[(argc + 1) * 8] : receiver
+  //  -- sp[(argc - n - 1) * 4] : arg[n] (zero based)
+  //  -- sp[argc * 4]           : receiver
   // -----------------------------------
   Condition const cond_done = (kind == MathMaxMinKind::kMin) ? lt : gt;
   Heap::RootListIndex const root_index =
@@ -150,15 +150,16 @@ void Builtins::Generate_MathMaxMin(MacroAssembler* masm, MathMaxMinKind kind) {
   __ addi(r7, r3, Operand(1));
 
   Label done_loop, loop;
+  __ mr(r7, r3);
   __ bind(&loop);
   {
     // Check if all parameters done.
-    __ subi(r3, r3, Operand(1));
-    __ cmpi(r3, Operand::Zero());
+    __ subi(r7, r7, Operand(1));
+    __ cmpi(r7, Operand::Zero());
     __ blt(&done_loop);
 
     // Load the next parameter tagged value into r5.
-    __ ShiftLeftImm(r5, r3, Operand(kPointerSizeLog2));
+    __ ShiftLeftImm(r5, r7, Operand(kPointerSizeLog2));
     __ LoadPX(r5, MemOperand(sp, r5));
 
     // Load the double value of the parameter into d2, maybe converting the
@@ -232,8 +233,10 @@ void Builtins::Generate_MathMaxMin(MacroAssembler* masm, MathMaxMinKind kind) {
   }
 
   __ bind(&done_loop);
+  // Drop all slots, including the receiver.
+  __ addi(r3, r3, Operand(1));
+  __ Drop(r3);
   __ mr(r3, r8);
-  __ Drop(r7);
   __ Ret();
 }
 

src/s390/builtins-s390.cc

@@ -123,8 +123,8 @@ void Builtins::Generate_MathMaxMin(MacroAssembler* masm, MathMaxMinKind kind) {
   //  -- r3                     : function
   //  -- cp                     : context
   //  -- lr                     : return address
-  //  -- sp[(argc - n) * 8] : arg[n] (zero-based)
-  //  -- sp[(argc + 1) * 8] : receiver
+  //  -- sp[(argc - n - 1) * 4] : arg[n] (zero based)
+  //  -- sp[argc * 4]           : receiver
   // -----------------------------------
   Condition const cond_done = (kind == MathMaxMinKind::kMin) ? lt : gt;
   Heap::RootListIndex const root_index =
@@ -143,14 +143,15 @@ void Builtins::Generate_MathMaxMin(MacroAssembler* masm, MathMaxMinKind kind) {
   __ AddP(r6, r2, Operand(1));
 
   Label done_loop, loop;
+  __ LoadRR(r6, r2);
   __ bind(&loop);
   {
     // Check if all parameters done.
-    __ SubP(r2, Operand(1));
+    __ SubP(r6, Operand(1));
     __ blt(&done_loop);
 
     // Load the next parameter tagged value into r2.
-    __ ShiftLeftP(r1, r2, Operand(kPointerSizeLog2));
+    __ ShiftLeftP(r1, r6, Operand(kPointerSizeLog2));
     __ LoadP(r4, MemOperand(sp, r1));
 
     // Load the double value of the parameter into d2, maybe converting the
@@ -219,8 +220,10 @@ void Builtins::Generate_MathMaxMin(MacroAssembler* masm, MathMaxMinKind kind) {
   }
 
   __ bind(&done_loop);
+  // Drop all slots, including the receiver.
+  __ AddP(r2, Operand(1));
+  __ Drop(r2);
   __ LoadRR(r2, r7);
-  __ Drop(r6);
   __ Ret();
 }