[builtins] Fix crash on stack overflow in CheckSpreadAndPushToStack.

src/builtins/ia32/builtins-ia32.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_IA32
 
 #include "src/code-factory.h"
 #include "src/codegen.h"
 #include "src/deoptimizer.h"
 #include "src/full-codegen/full-codegen.h"
@@ skipping 2824 matching lines @@
     __ mov(spread, eax);
     __ Pop(argc);
     __ SmiUntag(argc);
     __ Pop(edx);
     __ Pop(edi);
     // Free up some registers.
     __ movd(xmm0, edx);
     __ movd(xmm1, edi);
   }
 
-  Register return_address = edi;
   {
     // Calculate the new nargs including the result of the spread.
     __ mov(spread_len, FieldOperand(spread, FixedArray::kLengthOffset));
     __ SmiUntag(spread_len);
 
     __ bind(&push_args);
     // argc += spread_len - 1. Subtract 1 for the spread itself.
     __ lea(argc, Operand(argc, spread_len, times_1, -1));
-
-    // Pop the return address and spread argument.
-    __ PopReturnAddressTo(return_address);
-    __ Pop(scratch);
   }
 
   // Check for stack overflow.
   {
     // Check the stack for overflow. We are not trying to catch interruptions
     // (i.e. debug break and preemption) here, so check the "real stack limit".
     Label done;
     __ LoadRoot(scratch, Heap::kRealStackLimitRootIndex);
     // Make scratch the space we have left. The stack might already be
     // overflowed here which will cause scratch to become negative.
     __ neg(scratch);
     __ add(scratch, esp);
     __ sar(scratch, kPointerSizeLog2);
     // Check if the arguments will overflow the stack.
     __ cmp(scratch, spread_len);
     __ j(greater, &done, Label::kNear);  // Signed comparison.
     __ TailCallRuntime(Runtime::kThrowStackOverflow);
     __ bind(&done);
   }
 
   // Put the evaluated spread onto the stack as additional arguments.
   {
+    Register return_address = edi;
+    // Pop the return address and spread argument.
+    __ PopReturnAddressTo(return_address);
+    __ Pop(scratch);
+
     Register scratch2 = esi;
     __ movd(xmm2, esi);
 
     __ mov(scratch, Immediate(0));
     Label done, loop;
     __ bind(&loop);
     __ cmp(scratch, spread_len);
     __ j(equal, &done, Label::kNear);
     __ mov(scratch2, FieldOperand(spread, scratch, times_pointer_size,
                                   FixedArray::kHeaderSize));
@@ skipping 473 matching lines @@
 
 void Builtins::Generate_InterpreterOnStackReplacement(MacroAssembler* masm) {
   Generate_OnStackReplacementHelper(masm, true);
 }
 
 #undef __
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_IA32