This regression is due to miscalculating the mapped_count in escape-analysis-reducer.

Since NewArguemntsElements contains the entire arguments count instead of the rest argument size, we need to subtract (or add in the case of the reversed arguments stack) the formal parameter count to the index.

Change-Id: I865018573fc3b0f0d20f7286653b7f6803cbe665
Bug: chromium:1106667
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304576
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68963}