X87: [builtins] NonNumberToNumber and StringToNumber now use CallRuntime...

X87: [builtins] NonNumberToNumber and StringToNumber now use CallRuntime instead of TailCallRuntime.

  port b5c69cbf (r37132)

  original commit message:
  With the tail call, pointers to the JS heap could be pushed on a
  js-to-wasm frame. On the js-to-wasm frame, however, this pointer would
  not be updated by the GC.

BUG=

Review-Url: https://codereview.chromium.org/2108543002
Cr-Commit-Position: refs/heads/master@{#37319}

src/x87/builtins-x87.cc

@@ -2692,10 +2692,15 @@ void Builtins::Generate_StringToNumber(MacroAssembler* masm) {
   __ Ret();
 
   __ bind(&runtime);
-  __ PopReturnAddressTo(ecx);     // Pop return address.
-  __ Push(eax);                   // Push argument.
-  __ PushReturnAddressFrom(ecx);  // Push return address.
-  __ TailCallRuntime(Runtime::kStringToNumber);
+  {
+    FrameScope frame(masm, StackFrame::INTERNAL);
+    // Push argument.
+    __ push(eax);
+    // We cannot use a tail call here because this builtin can also be called
+    // from wasm.
+    __ CallRuntime(Runtime::kStringToNumber);
+  }
+  __ Ret();
 }
 
 // static
@@ -2736,11 +2741,15 @@ void Builtins::Generate_NonNumberToNumber(MacroAssembler* masm) {
   __ mov(eax, FieldOperand(eax, Oddball::kToNumberOffset));
   __ Ret();
   __ bind(&not_oddball);
-
-  __ pop(ecx);   // Pop return address.
-  __ push(eax);  // Push argument.
-  __ push(ecx);  // Push return address.
-  __ TailCallRuntime(Runtime::kToNumber);
+  {
+    FrameScope frame(masm, StackFrame::INTERNAL);
+    // Push argument.
+    __ push(eax);
+    // We cannot use a tail call here because this builtin can also be called
+    // from wasm.
+    __ CallRuntime(Runtime::kToNumber);
+  }
+  __ Ret();
 }
 
 void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {