[wasm] Support validation of asm.js modules with != 3 args.

src/runtime/runtime-compiler.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/asmjs/asm-js.h"
 #include "src/compiler.h"
 #include "src/deoptimizer.h"
@@ skipping 83 matching lines @@
     memory = args.at<i::JSArrayBuffer>(3);
   }
   if (args[1]->IsJSObject()) {
     MaybeHandle<Object> result;
     result = AsmJs::InstantiateAsmWasm(
         isolate, handle(function->shared()->asm_wasm_data()), memory, foreign);
     if (!result.is_null()) {
       return *result.ToHandleChecked();
     }
   }
-  // Remove wasm data and return a smi 0 to indicate failure.
+  // Remove wasm data, mark as broken for asm->wasm,
+  // replace code with CompileLazy, and return a smi 0 to indicate failure.
   function->shared()->ClearAsmWasmData();
+  function->shared()->set_is_asm_wasm_broken(true);
+  DCHECK(function->code() ==
+         isolate->builtins()->builtin(Builtins::kInstantiateAsmJs));
+  function->ReplaceCode(isolate->builtins()->builtin(Builtins::kCompileLazy));
+  function->shared()->ReplaceCode(

[Michael Starzinger, 2016/08/12 09:21:55]

Replacing the code on the SharedFunctionInfo is dangerous, we cannot guarantee
that it hasn't already been re-compiled by FullCodegen before due to another
closure of the same module failing. We would regenerate the full-codegen code
and could have activations of both the old and the new version on the stack. Can
we make sure to only replace the shared code if it still is the instantiation
builtin?

if (function->shared()->code() ==
isolate->builtins()->builtin(Builtins::kInstantiateAsmJs)) {
  function->shared()->ReplaceCode(...);
}

[bradn, 2016/08/12 18:50:02]

Done.

+      isolate->builtins()->builtin(Builtins::kCompileLazy));
   return Smi::FromInt(0);
 }
 
 RUNTIME_FUNCTION(Runtime_NotifyStubFailure) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 0);
   Deoptimizer* deoptimizer = Deoptimizer::Grab(isolate);
   DCHECK(AllowHeapAllocation::IsAllowed());
   delete deoptimizer;
   return isolate->heap()->undefined_value();
@@ skipping 313 matching lines @@
   DCHECK(is_valid_language_mode(args.smi_at(3)));
   LanguageMode language_mode = static_cast<LanguageMode>(args.smi_at(3));
   DCHECK(args[4]->IsSmi());
   Handle<SharedFunctionInfo> outer_info(args.at<JSFunction>(2)->shared(),
                                         isolate);
   return CompileGlobalEval(isolate, args.at<String>(1), outer_info,
                            language_mode, args.smi_at(4), args.smi_at(5));
 }
 }  // namespace internal
 }  // namespace v8