[wasm] Support validation of asm.js modules with != 3 args.

src/builtins/x87/builtins-x87.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_X87
 
 #include "src/code-factory.h"
 #include "src/codegen.h"
 #include "src/deoptimizer.h"
 #include "src/full-codegen/full-codegen.h"
@@ skipping 993 matching lines @@
 
 void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- eax : argument count (preserved for callee)
   //  -- edx : new target (preserved for callee)
   //  -- edi : target function (preserved for callee)
   // -----------------------------------
   Label failed;
   {
     FrameScope scope(masm, StackFrame::INTERNAL);
+    // Preserve argument count for later compare.
+    __ mov(ecx, eax);
     // Push the number of arguments to the callee.
     __ SmiTag(eax);
     __ push(eax);
     // Push a copy of the target function and the new target.
     __ push(edi);
     __ push(edx);
 
     // The function.
     __ push(edi);
     // Copy arguments from caller (stdlib, foreign, heap).
-    for (int i = 2; i >= 0; --i) {
-      __ push(Operand(
-          ebp, StandardFrameConstants::kCallerSPOffset + i * kPointerSize));
+    Label args_done;
+    for (int j = 0; j < 4; ++j) {
+      Label over;
+      if (j < 3) {
+        __ cmp(ecx, Immediate(j));
+        __ j(not_equal, &over, Label::kNear);
+      }
+      for (int i = j - 1; i >= 0; --i) {
+        __ Push(Operand(
+            ebp, StandardFrameConstants::kCallerSPOffset + i * kPointerSize));
+      }
+      for (int i = 0; i < 3 - j; ++i) {
+        __ PushRoot(Heap::kUndefinedValueRootIndex);
+      }
+      if (j < 3) {
+        __ jmp(&args_done, Label::kNear);
+        __ bind(&over);
+      }
     }
+    __ bind(&args_done);
+
     // Call runtime, on success unwind frame, and parent frame.
     __ CallRuntime(Runtime::kInstantiateAsmJs, 4);
     // A smi 0 is returned on failure, an object on success.
     __ JumpIfSmi(eax, &failed, Label::kNear);
+
+    __ Drop(2);
+    __ Pop(ecx);
+    __ SmiUntag(ecx);
     scope.GenerateLeaveFrame();
-    __ ret(4 * kPointerSize);
+
+    __ PopReturnAddressTo(ebx);
+    __ inc(ecx);
+    __ lea(esp, Operand(esp, ecx, times_pointer_size, 0));
+    __ PushReturnAddressFrom(ebx);
+    __ ret(0);
 
     __ bind(&failed);
     // Restore target function and new target.
     __ pop(edx);
     __ pop(edi);
     __ pop(eax);
     __ SmiUntag(eax);
   }
   // On failure, tail call back to regular js.
   GenerateTailCallToReturnedCode(masm, Runtime::kCompileLazy);
@@ skipping 1981 matching lines @@
 
 void Builtins::Generate_InterpreterOnStackReplacement(MacroAssembler* masm) {
   Generate_OnStackReplacementHelper(masm, true);
 }
 
 #undef __
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_X87