[wasm] Support validation of asm.js modules with != 3 args.

src/builtins/x64/builtins-x64.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_X64
 
 #include "src/code-factory.h"
 #include "src/codegen.h"
 #include "src/deoptimizer.h"
 #include "src/full-codegen/full-codegen.h"
@@ skipping 1044 matching lines @@
 
 void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- rax : argument count (preserved for callee)
   //  -- rdx : new target (preserved for callee)
   //  -- rdi : target function (preserved for callee)
   // -----------------------------------
   Label failed;
   {
     FrameScope scope(masm, StackFrame::INTERNAL);
+    // Preserve argument count for later compare.
+    __ movp(kScratchRegister, rax);
     // Push the number of arguments to the callee.
     __ Integer32ToSmi(rax, rax);
     __ Push(rax);
     // Push a copy of the target function and the new target.
     __ Push(rdi);
     __ Push(rdx);
 
     // The function.
     __ Push(rdi);
     // Copy arguments from caller (stdlib, foreign, heap).
-    for (int i = 2; i >= 0; --i) {
-      __ Push(Operand(
-          rbp, StandardFrameConstants::kCallerSPOffset + i * kPointerSize));
-    }
+    Label args_done;
+    __ cmpp(kScratchRegister, Immediate(0));
+    __ j(equal, &args_done, Label::kNear);
+
+    Label args2;
+    __ cmpp(kScratchRegister, Immediate(1));
+    __ j(not_equal, &args2, Label::kNear);
+    __ Push(Operand(
+        rbp, StandardFrameConstants::kCallerSPOffset + 0 * kPointerSize));
+    __ jmp(&args_done, Label::kNear);
+
+    __ bind(&args2);
+    Label args3;
+    __ cmpp(kScratchRegister, Immediate(2));
+    __ j(not_equal, &args3, Label::kNear);
+    __ Push(Operand(
+        rbp, StandardFrameConstants::kCallerSPOffset + 1 * kPointerSize));
+    __ Push(Operand(
+        rbp, StandardFrameConstants::kCallerSPOffset + 0 * kPointerSize));
+    __ jmp(&args_done, Label::kNear);
+
+    __ bind(&args3);
+    __ Push(Operand(
+        rbp, StandardFrameConstants::kCallerSPOffset + 2 * kPointerSize));
+    __ Push(Operand(
+        rbp, StandardFrameConstants::kCallerSPOffset + 1 * kPointerSize));
+    __ Push(Operand(
+        rbp, StandardFrameConstants::kCallerSPOffset + 0 * kPointerSize));
+    __ bind(&args_done);
+
+    // Increment and restore argument count to call runtime method
+    // with function as extra argument.
+    __ incp(kScratchRegister);
+    __ movp(rax, kScratchRegister);
     // Call runtime, on success unwind frame, and parent frame.
-    __ CallRuntime(Runtime::kInstantiateAsmJs, 4);
+    __ CallRuntime(Runtime::kInstantiateAsmJs, -1);

[Michael Starzinger, 2016/08/09 15:48:08]

For the call-site to not pass the arguments count is currently not supported.
And I don't think we want to go down that path. Even if the implementation of
the runtime function has var-args semantics, the call-site should always
statically know the argument count. See my comment in runtime.h to avoid this
issue completely.

[bradn, 2016/08/11 09:19:33]

Ah, great idea!
I like that much better.
Done.

     // A smi 0 is returned on failure, an object on success.
     __ JumpIfSmi(rax, &failed, Label::kNear);
+
+    __ Pop(kScratchRegister);
+    __ Pop(kScratchRegister);
+    __ Pop(kScratchRegister);
+    __ SmiToInteger32(kScratchRegister, kScratchRegister);
     scope.GenerateLeaveFrame();
-    __ ret(4 * kPointerSize);
+
+    __ Pop(rbx);
+    __ incp(kScratchRegister);
+    __ leap(rsp, Operand(rsp, kScratchRegister, times_pointer_size, 0));
+    __ Push(rbx);
+    __ ret(0);
 
     __ bind(&failed);
     // Restore target function and new target.
     __ Pop(rdx);
     __ Pop(rdi);
     __ Pop(rax);
     __ SmiToInteger32(rax, rax);
   }
   // On failure, tail call back to regular js.
-  GenerateTailCallToReturnedCode(masm, Runtime::kCompileLazy);
+  GenerateTailCallToReturnedCode(masm, Runtime::kCompileBaseline);
 }
 
 static void GenerateMakeCodeYoungAgainCommon(MacroAssembler* masm) {
   // For now, we are relying on the fact that make_code_young doesn't do any
   // garbage collection which allows us to save/restore the registers without
   // worrying about which of them contain pointers. We also don't build an
   // internal frame to make the code faster, since we shouldn't have to do stack
   // crawls in MakeCodeYoung. This seems a bit fragile.
 
   // Re-execute the code that was patched back to the young age when
@@ skipping 1963 matching lines @@
 void Builtins::Generate_InterpreterOnStackReplacement(MacroAssembler* masm) {
   Generate_OnStackReplacementHelper(masm, true);
 }
 
 #undef __
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_X64