[TurboProp] Fix dynamic check maps register saving on x64

BUG=chromium:1155499,chromium:1154961

Change-Id: I29948a63e477ef28b7599eb53db17b127662a641
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2574697
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71637}

src/builtins/x64/builtins-x64.cc

@@ -4272,7 +4272,7 @@ void Builtins::Generate_DynamicCheckMapsTrampoline(MacroAssembler* masm) {
   RegList registers = descriptor.allocatable_registers();
   // FLAG_debug_code is enabled CSA checks will call C function and so we need
   // to save all CallerSaved registers too.
-  if (FLAG_debug_code) registers |= kJSCallerSaved;
+  if (FLAG_debug_code) registers |= kCallerSaved;
   __ SaveRegisters(registers);
 
   __ Call(BUILTIN_CODE(masm->isolate(), DynamicCheckMaps),

src/codegen/x64/register-x64.h

@@ -82,6 +82,13 @@ constexpr RegList kJSCallerSaved =
                      rbx,  // used as a caller-saved register in JavaScript code
                      rdi);  // callee function
 
+constexpr RegList kCallerSaved =
+#ifdef V8_TARGET_OS_WIN
+    Register::ListOf(rax, rcx, rdx, r8, r9, r10, r11);
+#else
+    Register::ListOf(rax, rcx, rdx, rdi, rsi, r8, r9, r10, r11);
+#endif  // V8_TARGET_OS_WIN
+
 constexpr int kNumJSCallerSaved = 5;
 
 // Number of registers for which space is reserved in safepoints.

test/mjsunit/regress/regress-1154961.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turboprop --stack-size=100
+
+function runNearStackLimit(f) {
+  function t() {
+    try {
+      return t();
+    } catch (e) {
+      return f();
+    }
+  }
+  return t();
+}
+
+function baz(f) {
+  return [[f(1)], 1, 2, 3, 4, 5, 6, 7, 8];
+}
+
+function foo(__v_3) {
+  try {
+    var arr = baz(__v_3);
+  } catch (e) {}
+  try {
+    for (var i = 0; i < arr.length; i++) {
+      function bar() {
+        return arr[i];
+      }
+      try {
+        throw e;
+      } catch (e) {}
+    }
+  } catch (e) {}
+}
+
+%PrepareFunctionForOptimization(foo);
+foo(a => a);
+foo(a => a);
+%OptimizeFunctionOnNextCall(foo);
+runNearStackLimit(() => { foo(a => a); });