deps: backport 102e3e87e7 from V8 upstream

This commit backports a fix to a crankshaft bug affects arm64 systems.

Original commit message:

    [arm64] Fix jssp based spill slot accesses in Crankshaft

    Review URL: https://codereview.chromium.org/1401703003

    Cr-Commit-Position: refs/heads/master@{#31304}

Fixes: #7417
PR-URL: #7442
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

deps/v8/src/arm64/lithium-codegen-arm64.cc

@@ -2801,6 +2801,8 @@ void LCodeGen::DoDoubleToIntOrSmi(LDoubleToIntOrSmi* instr) {
 
 void LCodeGen::DoDrop(LDrop* instr) {
   __ Drop(instr->count());
+
+  RecordPushedArgumentsDelta(instr->hydrogen_value()->argument_delta());
 }
 
 

deps/v8/test/mjsunit/regress/regress-arm64-spillslots.js

@@ -0,0 +1,34 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+
+function Message(message) {
+  this.message = message;
+}
+
+function Inlined(input) {
+  var dummy = arguments[1] === undefined;
+  if (input instanceof Message) {
+    return input;
+  }
+  print("unreachable, but we must create register allocation complexity");
+  return [];
+}
+
+function Process(input) {
+  var ret = [];
+  ret.push(Inlined(input[0], 1, 2));
+  return ret;
+}
+
+var input = [new Message("TEST PASS")];
+
+Process(input);
+Process(input);
+%OptimizeFunctionOnNextCall(Process);
+var result = Process(input);
+assertEquals("TEST PASS", result[0].message);