From 6b03f2233f79f6f83cf96a54580d1a93405cb63a Mon Sep 17 00:00:00 2001
From: "paul.lind" <paul.lind@imgtec.com>
Date: Thu, 2 Apr 2015 08:19:45 -0700
Subject: [PATCH] MIPS: Fix another bug with mozilla regress-396684.js

As with TF fix 94506cc3, correctly support absurdly large stack
adjustments.

TEST=mozilla/js/tests/js1_5/Regress/regress-396684.js
BUG=

Review URL: https://codereview.chromium.org/1057763002

Cr-Commit-Position: refs/heads/master@{#27592}
---
 src/mips/macro-assembler-mips.cc     | 3 ++-
 src/mips64/macro-assembler-mips64.cc | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/mips/macro-assembler-mips.cc b/src/mips/macro-assembler-mips.cc
index 24c6987276..1585e3187f 100644
--- a/src/mips/macro-assembler-mips.cc
+++ b/src/mips/macro-assembler-mips.cc
@@ -3151,6 +3151,7 @@ void MacroAssembler::Jalr(Label* L, BranchDelaySlot bdslot) {
 
 
 void MacroAssembler::DropAndRet(int drop) {
+  DCHECK(is_int16(drop * kPointerSize));
   Ret(USE_DELAY_SLOT);
   addiu(sp, sp, drop * kPointerSize);
 }
@@ -3188,7 +3189,7 @@ void MacroAssembler::Drop(int count,
      Branch(&skip, NegateCondition(cond), reg, op);
   }
 
-  addiu(sp, sp, count * kPointerSize);
+  Addu(sp, sp, Operand(count * kPointerSize));
 
   if (cond != al) {
     bind(&skip);
diff --git a/src/mips64/macro-assembler-mips64.cc b/src/mips64/macro-assembler-mips64.cc
index 759e990890..cfbfbe3080 100644
--- a/src/mips64/macro-assembler-mips64.cc
+++ b/src/mips64/macro-assembler-mips64.cc
@@ -3164,6 +3164,7 @@ void MacroAssembler::Jalr(Label* L, BranchDelaySlot bdslot) {
 
 
 void MacroAssembler::DropAndRet(int drop) {
+  DCHECK(is_int16(drop * kPointerSize));
   Ret(USE_DELAY_SLOT);
   daddiu(sp, sp, drop * kPointerSize);
 }
@@ -3201,7 +3202,7 @@ void MacroAssembler::Drop(int count,
      Branch(&skip, NegateCondition(cond), reg, op);
   }
 
-  daddiu(sp, sp, count * kPointerSize);
+  Daddu(sp, sp, Operand(count * kPointerSize));
 
   if (cond != al) {
     bind(&skip);