[runtime] Fix arguments length DCHECK

... in Runtime::kCopyDataPropertiesWithExcludedPropertiesOnStack.

Bug: v8:11614
Change-Id: Ief6d62fff242d3d38c4e586c7252935d3527ddf1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3581534Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#79937}

src/runtime/runtime-object.cc

@@ -1337,7 +1337,7 @@ void CheckExcludedPropertiesAreOnCallerStack(Isolate* isolate, Address base,
 
 RUNTIME_FUNCTION(Runtime_CopyDataPropertiesWithExcludedPropertiesOnStack) {
   HandleScope scope(isolate);
-  DCHECK_LE(3, args.length());
+  DCHECK_EQ(3, args.length());
   Handle<Object> source = args.at(0);
   int excluded_property_count = args.smi_value_at(1);
   // The excluded_property_base is passed as a raw stack pointer. This is safe

test/mjsunit/regress/regress-v8-11614.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Deconstructing will goto fast path.
+const fastProps = { key: "abc", ref: 1234, a: 10, b: 20, c: 30, d: 40, e: 50 };
+
+const { key, ref, ...normalizedFastProps } = fastProps;
+
+// Deconstructing will goto runtime, call
+// Runtime:: kCopyDataPropertiesWithExcludedPropertiesOnStack.
+// Add a large index to force dictionary elements.
+const slowProps = { [2**30] : 10};
+assertTrue(%HasDictionaryElements(slowProps));
+const { ...normalizedSlowProps } = slowProps;