[asm.js] Enforce maximum number of parameters for asm.js.

R=bradnelson@chromium.org

Bug: chromium:810973
Change-Id: I818c17ef03b27df72976048b1873fc3f3a368900
Reviewed-on: https://chromium-review.googlesource.com/914330Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51252}

src/asmjs/asm-parser.cc

@@ -745,6 +745,12 @@ void AsmJsParser::ValidateFunction() {
 
   CachedVector<AsmType*> params(cached_asm_type_p_vectors_);
   ValidateFunctionParams(&params);
+
+  // Check against limit on number of parameters.
+  if (params.size() >= kV8MaxWasmFunctionParams) {
+    FAIL("Number of parameters exceeds internal limit");
+  }
+
   CachedVector<ValueType> locals(cached_valuetype_vectors_);
   ValidateFunctionLocals(params.size(), &locals);
 

test/mjsunit/regress/wasm/regress-810973.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+  this.WScript = new Proxy({}, {
+    get() {
+      switch (name) {
+      }
+    }
+  });
+function MjsUnitAssertionError() {
+};
+let __v_692 = `(function module() { "use asm";function foo(`;
+const __v_693 =
+3695;
+for (let __v_695 = 0; __v_695 < __v_693; ++__v_695) {
+    __v_692 += `arg${__v_695},`;
+}
+try {
+  __v_692 += `arg${__v_693}){`;
+} catch (e) {}
+for (let __v_696 = 0; __v_696 <= __v_693; ++__v_696) {
+    __v_692 += `arg${__v_696}=+arg${__v_696};`;
+}
+  __v_692 += "return 10;}function bar(){return foo(";
+for (let __v_697 = 0; __v_697 < __v_693; ++__v_697) {
+    __v_692 += "0.0,";
+}
+  __v_692 += "1.0)|0;}";
+
+  __v_692 += "return bar})()()";
+const __v_694 = eval(__v_692);