[turbofan] Support variable size argument popping in TF-generated functions

src/code-stubs.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/code-stubs.h"
 
 #include <sstream>
 
 #include "src/ast/ast.h"
 #include "src/bootstrapper.h"
@@ skipping 2882 matching lines @@
     assembler->Comment("fast double elements path");
     if (FLAG_debug_code) {
       Label correct_elements_map(assembler), abort(assembler, Label::kDeferred);
       assembler->Branch(assembler->IsFixedDoubleArrayMap(elements_map),
                         &correct_elements_map, &abort);
 
       assembler->Bind(&abort);
       {
         Node* abort_id = assembler->SmiConstant(
             Smi::FromInt(BailoutReason::kExpectedFixedDoubleArrayMap));
-        assembler->TailCallRuntime(Runtime::kAbort, context, abort_id);
+        assembler->CallRuntime(Runtime::kAbort, context, abort_id);
+        result.Bind(assembler->UndefinedConstant());

[danno, 2016/10/25 06:43:32]

It's not a good idea to tail call with a different return signature, which can
happen easily by tail-calling abort from a stub that doesn't return a value.
This started triggering CHECKs when tinkering with this CL.

+        assembler->Goto(&return_result);
       }
       assembler->Bind(&correct_elements_map);
     }
 
     Node* array = NonEmptyShallowClone(assembler, boilerplate, boilerplate_map,
                                        boilerplate_elements, allocation_site,
                                        capacity, FAST_DOUBLE_ELEMENTS);
     result.Bind(array);
     assembler->Goto(&return_result);
   }
@@ skipping 412 matching lines @@
 
   if (type == MachineType::Pointer()) {
     return Representation::External();
   }
 
   return Representation::Tagged();
 }
 
 }  // namespace internal
 }  // namespace v8