[wasm] Support validation of asm.js modules with != 3 args.

src/builtins/x64/builtins-x64.cc

Index: src/builtins/x64/builtins-x64.cc
diff --git a/src/builtins/x64/builtins-x64.cc b/src/builtins/x64/builtins-x64.cc
index d7bc75fcb3fa7688b7f32c5d5d2a9d2bd7c1ae4a..306eb8943176d3af8d5dc8ccf89ff918044d3772 100644
--- a/src/builtins/x64/builtins-x64.cc
+++ b/src/builtins/x64/builtins-x64.cc
@@ -1062,6 +1062,8 @@ void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
   Label failed;
   {
     FrameScope scope(masm, StackFrame::INTERNAL);
+    // Preserve argument count for later compare.
+    __ movp(kScratchRegister, rax);
     // Push the number of arguments to the callee.
     __ Integer32ToSmi(rax, rax);
     __ Push(rax);
@@ -1072,16 +1074,56 @@ void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
     // The function.
     __ Push(rdi);
     // Copy arguments from caller (stdlib, foreign, heap).
-    for (int i = 2; i >= 0; --i) {
-      __ Push(Operand(
-          rbp, StandardFrameConstants::kCallerSPOffset + i * kPointerSize));
-    }
+    Label args_done;
+    __ cmpp(kScratchRegister, Immediate(0));
+    __ j(equal, &args_done, Label::kNear);
+
+    Label args2;
+    __ cmpp(kScratchRegister, Immediate(1));
+    __ j(not_equal, &args2, Label::kNear);
+    __ Push(Operand(
+        rbp, StandardFrameConstants::kCallerSPOffset + 0 * kPointerSize));
+    __ jmp(&args_done, Label::kNear);
+
+    __ bind(&args2);
+    Label args3;
+    __ cmpp(kScratchRegister, Immediate(2));
+    __ j(not_equal, &args3, Label::kNear);
+    __ Push(Operand(
+        rbp, StandardFrameConstants::kCallerSPOffset + 1 * kPointerSize));
+    __ Push(Operand(
+        rbp, StandardFrameConstants::kCallerSPOffset + 0 * kPointerSize));
+    __ jmp(&args_done, Label::kNear);
+
+    __ bind(&args3);
+    __ Push(Operand(
+        rbp, StandardFrameConstants::kCallerSPOffset + 2 * kPointerSize));
+    __ Push(Operand(
+        rbp, StandardFrameConstants::kCallerSPOffset + 1 * kPointerSize));
+    __ Push(Operand(
+        rbp, StandardFrameConstants::kCallerSPOffset + 0 * kPointerSize));
+    __ bind(&args_done);
+
+    // Increment and restore argument count to call runtime method
+    // with function as extra argument.
+    __ incp(kScratchRegister);
+    __ movp(rax, kScratchRegister);
     // Call runtime, on success unwind frame, and parent frame.
-    __ CallRuntime(Runtime::kInstantiateAsmJs, 4);
+    __ CallRuntime(Runtime::kInstantiateAsmJs, -1);

[Michael Starzinger, 2016/08/09 15:48:08]

For the call-site to not pass the arguments count is currently not supported.
And I don't think we want to go down that path. Even if the implementation of
the runtime function has var-args semantics, the call-site should always
statically know the argument count. See my comment in runtime.h to avoid this
issue completely.

[bradn, 2016/08/11 09:19:33]

Ah, great idea!
I like that much better.
Done.

     // A smi 0 is returned on failure, an object on success.
     __ JumpIfSmi(rax, &failed, Label::kNear);
+
+    __ Pop(kScratchRegister);
+    __ Pop(kScratchRegister);
+    __ Pop(kScratchRegister);
+    __ SmiToInteger32(kScratchRegister, kScratchRegister);
     scope.GenerateLeaveFrame();
-    __ ret(4 * kPointerSize);
+
+    __ Pop(rbx);
+    __ incp(kScratchRegister);
+    __ leap(rsp, Operand(rsp, kScratchRegister, times_pointer_size, 0));
+    __ Push(rbx);
+    __ ret(0);
 
     __ bind(&failed);
     // Restore target function and new target.
@@ -1091,7 +1133,7 @@ void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
     __ SmiToInteger32(rax, rax);
   }
   // On failure, tail call back to regular js.
-  GenerateTailCallToReturnedCode(masm, Runtime::kCompileLazy);
+  GenerateTailCallToReturnedCode(masm, Runtime::kCompileBaseline);
 }
 
 static void GenerateMakeCodeYoungAgainCommon(MacroAssembler* masm) {