[maglev] CallProperty input count should consider function

CallProperty IR has inputs 0 (function), 1 (context), and the
remaining are variable according to the register count.

Bug: v8:7700
Change-Id: Ie9d8785bd5c1ae878c664683f8ebcff4ce6c408a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3541924
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79562}

src/maglev/maglev-graph-builder.cc

@@ -380,9 +380,9 @@ void MaglevGraphBuilder::VisitCallProperty() {
   interpreter::RegisterList args = iterator_.GetRegisterListOperand(1);
   ValueNode* context = GetContext();
 
-  static constexpr int kTheContext = 1;
+  static constexpr int kTheContextAndTheFunction = 2;
   CallProperty* call_property = AddNewNode<CallProperty>(
-      args.register_count() + kTheContext, function, context);
+      args.register_count() + kTheContextAndTheFunction, function, context);
   // TODO(leszeks): Move this for loop into the CallProperty constructor,
   // pre-size the args array.
   for (int i = 0; i < args.register_count(); ++i) {