Bug 1530351 - GenerateProfilerExit frame use 64-bits math to remove the rectifier frame size. r=sstangl

Differential Revision: https://phabricator.services.mozilla.com/D25755

--HG--
extra : moz-landing-system : lando

js/src/jit-test/tests/profiler/ion-rectifier-frame-bug1530351.js

@@ -0,0 +1,6 @@
+function test(str) {
+  for (let i = 0; i < 100; ++i)
+    Reflect.apply(String.prototype.substring, str, [])
+}
+enableGeckoProfilingWithSlowAssertions();
+test("");

js/src/jit/arm64/Trampoline-arm64.cpp

@@ -1132,7 +1132,7 @@ void JitRuntime::generateProfilerExitFrameTailStub(MacroAssembler& masm,
     // scratch3 := RectFrame + Rect-Descriptor.Size +
     //             RectifierFrameLayout::Size()
     masm.addPtr(scratch2, scratch1, scratch3);
-    masm.add32(Imm32(RectifierFrameLayout::Size()), scratch3);
+    masm.addPtr(Imm32(RectifierFrameLayout::Size()), scratch3);
     masm.storePtr(scratch3, lastProfilingFrame);
     masm.ret();