[runtime] Set arguments limit to FixedArray::kMaxLength

Right now, this is the limit implicitly imposed for spread/apply calls
as to actually do a spread/apply call through CallVarargs, you need to
pass a FixedArray with the args to be pushed.

Likewise, turbofan can only materialize an arguments object with a
backing store of length FixedArray::kMaxLength.

The practical limit that users will actually hit is the stack - this
change doesn't change that, it just documents what the actual limit is.

This would actually allow an embedder/custom fork to increase stack
size and still be able to make spread/apply calls with a large number
of args.

Change-Id: If5e66a61ed3f9df36031eb098646d48fc2ca2507
Reviewed-on: https://chromium-review.googlesource.com/c/1367451Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58119}

src/builtins/builtins-call-gen.cc

@@ -194,6 +194,8 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructWithArrayLike(
     TNode<Int32T> length = var_length.value();
     {
       Label normalize_done(this);
+      CSA_ASSERT(this, Int32LessThanOrEqual(
+                           length, Int32Constant(FixedArray::kMaxLength)));
       GotoIfNot(Word32Equal(length, Int32Constant(0)), &normalize_done);
       // Make sure we don't accidentally pass along the
       // empty_fixed_double_array since the tailed-called stubs cannot handle
@@ -239,6 +241,8 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructDoubleVarargs(
     TNode<Int32T> args_count, TNode<Context> context, TNode<Int32T> kind) {
   const ElementsKind new_kind = PACKED_ELEMENTS;
   const WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER;
+  CSA_ASSERT(this, Int32LessThanOrEqual(length,
+                                        Int32Constant(FixedArray::kMaxLength)));
   TNode<IntPtrT> intptr_length = ChangeInt32ToIntPtr(length);
   CSA_ASSERT(this, WordNotEqual(intptr_length, IntPtrConstant(0)));
 
@@ -329,6 +333,8 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructWithSpread(
   {
     TNode<FixedArrayBase> elements = var_elements.value();
     TNode<Int32T> length = var_length.value();
+    CSA_ASSERT(this, Int32LessThanOrEqual(
+                         length, Int32Constant(FixedArray::kMaxLength)));
 
     if (new_target == nullptr) {
       Callable callable = CodeFactory::CallVarargs(isolate());

src/compiler/type-cache.h

@@ -165,8 +165,10 @@ class TypeCache final {
   Type const kJSDateYearType =
       Type::Union(Type::SignedSmall(), Type::NaN(), zone());
 
-  // The valid number of arguments for JavaScript functions.
-  Type const kArgumentsLengthType = Type::Unsigned30();
+  // The valid number of arguments for JavaScript functions. We can never
+  // materialize more than the max size of a fixed array, because we require a
+  // fixed array in spread/apply calls.
+  Type const kArgumentsLengthType = CreateRange(0.0, FixedArray::kMaxLength);
 
   // The JSArrayIterator::kind property always contains an integer in the
   // range [0, 2], representing the possible IterationKinds.

src/compiler/typer.cc

@@ -700,7 +700,7 @@ Type Typer::Visitor::TypeParameter(Node* node) {
       return Type::Union(Type::Receiver(), Type::Undefined(), typer_->zone());
     }
   } else if (index == Linkage::GetJSCallArgCountParamIndex(parameter_count)) {
-    return Type::Range(0.0, Code::kMaxArguments, typer_->zone());
+    return Type::Range(0.0, FixedArray::kMaxLength, typer_->zone());
   } else if (index == Linkage::GetJSCallContextParamIndex(parameter_count)) {
     return Type::OtherInternal();
   }

src/compiler/verifier.cc

@@ -1258,7 +1258,8 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       break;
     case IrOpcode::kNewArgumentsElements:
       CheckValueInputIs(node, 0, Type::ExternalPointer());
-      CheckValueInputIs(node, 1, Type::Unsigned30());
+      CheckValueInputIs(node, 1,
+                        Type::Range(0.0, FixedArray::kMaxLength, zone));
       CheckTypeIs(node, Type::OtherInternal());
       break;
     case IrOpcode::kNewConsString:

src/execution.cc

@@ -71,6 +71,7 @@ V8_WARN_UNUSED_RESULT MaybeHandle<Object> Invoke(
     Execution::Target execution_target) {
   RuntimeCallTimerScope timer(isolate, RuntimeCallCounterId::kInvoke);
   DCHECK(!receiver->IsJSGlobalObject());
+  DCHECK_LE(argc, FixedArray::kMaxLength);
 
 #ifdef USE_SIMULATOR
   // Simulators use separate stacks for C++ and JS. JS stack overflow checks