[builtins] Fix crash on stack overflow in CheckSpreadAndPushToStack.

src/builtins/x64/builtins-x64.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_X64
 
 #include "src/code-factory.h"
 #include "src/codegen.h"
 #include "src/deoptimizer.h"
 #include "src/full-codegen/full-codegen.h"
@@ skipping 2883 matching lines @@
     __ Pop(rdi);  // target
   }
 
   {
     // Calculate the new nargs including the result of the spread.
     __ SmiToInteger32(r9, FieldOperand(rbx, FixedArray::kLengthOffset));
 
     __ bind(&push_args);
     // rax += r9 - 1. Subtract 1 for the spread itself.
     __ leap(rax, Operand(rax, r9, times_1, -1));
-
-    // Pop the return address and spread argument.
-    __ PopReturnAddressTo(r8);
-    __ Pop(rcx);
   }
 
   // Check for stack overflow.
   {
     // Check the stack for overflow. We are not trying to catch interruptions
     // (i.e. debug break and preemption) here, so check the "real stack limit".
     Label done;
     __ LoadRoot(kScratchRegister, Heap::kRealStackLimitRootIndex);
     __ movp(rcx, rsp);
     // Make rcx the space we have left. The stack might already be overflowed
     // here which will cause rcx to become negative.
     __ subp(rcx, kScratchRegister);
     __ sarp(rcx, Immediate(kPointerSizeLog2));
     // Check if the arguments will overflow the stack.
     __ cmpp(rcx, r9);
     __ j(greater, &done, Label::kNear);  // Signed comparison.
     __ TailCallRuntime(Runtime::kThrowStackOverflow);
     __ bind(&done);
   }
 
   // Put the evaluated spread onto the stack as additional arguments.
   {
+    // Pop the return address and spread argument.
+    __ PopReturnAddressTo(r8);
+    __ Pop(rcx);
+
     __ Set(rcx, 0);
     Label done, loop;
     __ bind(&loop);
     __ cmpl(rcx, r9);
     __ j(equal, &done, Label::kNear);
     __ movp(kScratchRegister, FieldOperand(rbx, rcx, times_pointer_size,
                                            FixedArray::kHeaderSize));
     __ Push(kScratchRegister);
     __ incl(rcx);
     __ jmp(&loop);
@@ skipping 317 matching lines @@
 void Builtins::Generate_InterpreterOnStackReplacement(MacroAssembler* masm) {
   Generate_OnStackReplacementHelper(masm, true);
 }
 
 #undef __
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_X64