[wasm] Support validation of asm.js modules with != 3 args.

src/builtins/mips/builtins-mips.cc

Index: src/builtins/mips/builtins-mips.cc
diff --git a/src/builtins/mips/builtins-mips.cc b/src/builtins/mips/builtins-mips.cc
index f460fec7d4c4abd0ad40044e9a0715b5ff1d5a17..bd0e7e252da8726bdc454d895334cc9e9fc3931b 100644
--- a/src/builtins/mips/builtins-mips.cc
+++ b/src/builtins/mips/builtins-mips.cc
@@ -1444,23 +1444,47 @@ void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
   Label failed;
   {
     FrameScope scope(masm, StackFrame::INTERNAL);
+    // Preserve argument count for later compare.
+    __ Move(t4, a0);
     // Push a copy of the target function and the new target.
     // Push function as parameter to the runtime call.
     __ SmiTag(a0);
     __ Push(a0, a1, a3, a1);
 
     // Copy arguments from caller (stdlib, foreign, heap).
-    for (int i = 2; i >= 0; --i) {
-      __ lw(a3, MemOperand(fp, StandardFrameConstants::kCallerSPOffset +
-                                   i * kPointerSize));
-      __ push(a3);
+    Label args_done;
+    for (int j = 0; j < 4; ++j) {
+      Label over;
+      if (j < 3) {
+        __ Branch(&over, ne, t4, Operand(j));
+      }
+      for (int i = j - 1; i >= 0; --i) {
+        __ lw(t4, MemOperand(fp, StandardFrameConstants::kCallerSPOffset +
+                                     i * kPointerSize));
+        __ push(t4);
+      }
+      for (int i = 0; i < 3 - j; ++i) {
+        __ PushRoot(Heap::kUndefinedValueRootIndex);
+      }
+      if (j < 3) {
+        __ jmp(&args_done);
+        __ bind(&over);
+      }
     }
+    __ bind(&args_done);
+
     // Call runtime, on success unwind frame, and parent frame.
     __ CallRuntime(Runtime::kInstantiateAsmJs, 4);
     // A smi 0 is returned on failure, an object on success.
-    __ JumpIfSmi(a0, &failed);
+    __ JumpIfSmi(v0, &failed);
+
+    __ Drop(2);
+    __ pop(t4);
+    __ SmiUntag(t4);
     scope.GenerateLeaveFrame();
-    __ Drop(4);
+
+    __ Addu(t4, t4, Operand(1));
+    __ Lsa(sp, sp, t4, kPointerSizeLog2);
     __ Ret();
 
     __ bind(&failed);