[turbofan] Fix bug in Array.p.reduceRight

Bug: v8:7495
Change-Id: Id929804e0d0f78c17d81d07cd6a5c5e571449d35
Reviewed-on: https://chromium-review.googlesource.com/947974Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51720}

src/builtins/builtins-array-gen.cc

@@ -2682,7 +2682,7 @@ TF_BUILTIN(ArrayReduceRightPreLoopEagerDeoptContinuation,
   // the hole. The continuation stub will search for the initial non-hole
   // element, rightly throwing an exception if not found.
   Return(CallStub(stub, context, receiver, callbackfn, UndefinedConstant(),
-                  TheHoleConstant(), receiver, SmiConstant(0), len,
+                  TheHoleConstant(), receiver, SmiSub(len, SmiConstant(1)), len,
                   UndefinedConstant()));
 }
 

test/mjsunit/array-reduce.js

@@ -665,6 +665,16 @@ assertEquals(undefined, arr.reduceRight(function(val) { return val }));
   assertEquals(total, g());
 })();
 
+(function TriggerReduceRightPreLoopDeopt() {
+  function f(a) {
+    a.reduceRight((x) => { return x + 1 });
+  }
+  f([1,2,]);
+  f([1,2,]);
+  %OptimizeFunctionOnNextCall(f);
+  assertThrows(() => f([]), TypeError);
+})();
+
 (function OptimizedReduceRightEagerDeoptMiddleOfIterationHoley() {
   let deopt = false;
   let array = [, ,11,22,,33,45,56,,6,77,84,93,101,];