[maglev] CompactInterpreterFrameState fixes

Bug: v8:7700
Change-Id: I1efa298a25bf15c104a57db3ec7cc4d7e36861eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3553102Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79655}

src/maglev/maglev-interpreter-frame-state.h

@@ -113,20 +113,20 @@ class CompactInterpreterFrameState {
 
   template <typename Function>
   void ForEachLocal(const MaglevCompilationUnit& info, Function&& f) const {
+    int live_reg = 0;
     for (int register_index : *liveness_) {
       interpreter::Register reg = interpreter::Register(register_index);
-      f(live_registers_and_accumulator_[info.parameter_count() +
-                                        register_index],
+      f(live_registers_and_accumulator_[info.parameter_count() + live_reg++],
         reg);
     }
   }
 
   template <typename Function>
   void ForEachLocal(const MaglevCompilationUnit& info, Function&& f) {
+    int live_reg = 0;
     for (int register_index : *liveness_) {
       interpreter::Register reg = interpreter::Register(register_index);
-      f(live_registers_and_accumulator_[info.parameter_count() +
-                                        register_index],
+      f(live_registers_and_accumulator_[info.parameter_count() + live_reg++],
         reg);
     }
   }
@@ -134,7 +134,7 @@ class CompactInterpreterFrameState {
   template <typename Function>
   void ForAccumulator(const MaglevCompilationUnit& info, Function&& f) {
     if (liveness_->AccumulatorIsLive()) {
-      f(live_registers_and_accumulator_[0]);
+      f(live_registers_and_accumulator_[SizeFor(info, liveness_) - 1]);
     }
   }
 

test/mjsunit/maglev/19.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev
+
+function f(i) {
+  var j;
+  var o;
+  if (i) {
+  } else {
+    if (j) {
+    } else {
+    }
+  }
+  return o;
+}
+
+%PrepareFunctionForOptimization(f);
+f(false, true);
+
+%OptimizeMaglevOnNextCall(f);
+f(false, true);
+f(false, true);
+f(false, true);