[sparkplug] Re-fix frame fill on arm64

We had an off-by-one in the arm64 frame fill code due to double counting
the register already pushed by the prologue.

Bug: v8:11420
Change-Id: I9b4a3bcdc913886f0ba7a316f23f41eed3fc9311
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2707168
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72872}

src/baseline/arm64/baseline-compiler-arm64-inl.h

@@ -524,7 +524,9 @@ void BaselineCompiler::PrologueFillFrame() {
         __ masm()->Push(kInterpreterAccumulatorRegister,
                         kJavaScriptCallNewTargetRegister);
       }
-      register_count -= (index + 2);
+      // We pushed "index" registers, minus the one the prologue pushed, plus
+      // the two registers that included new_target.
+      register_count -= (index - 1 + 2);
     }
   }
   if (register_count < 2 * kLoopUnrollSize) {