Fix parameter passing in callback store ics on arm

R=svenpanne@chromium.org

BUG=

Review URL: https://codereview.chromium.org/93873007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18260 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/arm/stub-cache-arm.cc

@@ -911,12 +911,12 @@ static void GenerateFastApiCall(MacroAssembler* masm,
   __ str(receiver, MemOperand(sp, FCA::kHolderIndex * kPointerSize));
   // Write receiver to stack frame.
   int index = stack_space - 1;
-  __ str(receiver, MemOperand(sp, index * kPointerSize));
+  __ str(receiver, MemOperand(sp, index-- * kPointerSize));
   // Write the arguments to stack frame.
   for (int i = 0; i < argc; i++) {
     ASSERT(!receiver.is(values[i]));
     ASSERT(!scratch.is(values[i]));
-    __ str(receiver, MemOperand(sp, index-- * kPointerSize));
+    __ str(values[i], MemOperand(sp, index-- * kPointerSize));
   }
 
   GenerateFastApiDirectCall(masm, optimization, argc, true);

test/cctest/test-accessors.cc

@@ -205,21 +205,22 @@ THREADED_TEST(AccessorIC) {
     "var result = [];"
     "var key_0 = 'x0';"
     "var key_1 = 'x1';"
-    "for (var i = 0; i < 10; i++) {"
+    "for (var j = 0; j < 10; j++) {"
+    "  var i = 4*j;"
     "  holder.x0 = i;"
     "  result.push(obj.x0);"
-    "  holder.x1 = i;"
+    "  holder.x1 = i + 1;"
     "  result.push(obj.x1);"
-    "  holder[key_0] = i;"
+    "  holder[key_0] = i + 2;"
     "  result.push(obj[key_0]);"
-    "  holder[key_1] = i;"
+    "  holder[key_1] = i + 3;"
     "  result.push(obj[key_1]);"
     "}"
     "result"));
   CHECK_EQ(40, array->Length());
   for (int i = 0; i < 40; i++) {
     v8::Handle<Value> entry = array->Get(v8::Integer::New(i));
-    CHECK_EQ(v8::Integer::New(i/4), entry);
+    CHECK_EQ(v8::Integer::New(i), entry);
   }
 }