[turbofan] Fix wrong parameter indices in JSFrameSpecialization.

We forgot to add the number of arguments parameter in
JSFrameSpecialization, which was added before the context.

R=jarin@chromium.org
BUG=chromium:552304
LOG=n

Review URL: https://codereview.chromium.org/1429233004

Cr-Commit-Position: refs/heads/master@{#31856}

src/compiler/js-frame-specialization.cc

@@ -52,7 +52,10 @@ Reduction JSFrameSpecialization::ReduceParameter(Node* node) {
   if (index == Linkage::kJSFunctionCallClosureParamIndex) {
     object = frame()->function();
   } else if (index == parameters_count) {
-    // The Parameter index (arity + 1) is the context.
+    // The Parameter index (arity + 1) is the parameter count.
+    object = Smi::FromInt(parameters_count - 1);
+  } else if (index == parameters_count + 1) {
+    // The Parameter index (arity + 2) is the context.
     object = frame()->context();
   } else {
     // The Parameter index 0 is the receiver.

test/mjsunit/regress/regress-crbug-552304.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function() {
+  "use asm";
+  return function() {
+    for (var i = 0; i < 100000; delete unresolved_name) {++i}
+    return 0;
+  }
+})()(this + "i");