[wasm] Ensure stack space in PushReturns

Bonus: this contains small regression tests for the issues fixed in
https://chromium-review.googlesource.com/c/v8/v8/+/2739586.

Fixed: chromium:1186603
Change-Id: I6eca2ef41936555e6fe81555805a659b30023952
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2761201
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73436}

src/wasm/function-body-decoder-impl.h

@@ -4763,6 +4763,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     return values;
   }
   V8_INLINE void PushReturns(ReturnVector values) {
+    EnsureStackSpace(static_cast<int>(values.size()));
     for (Value& value : values) Push(value);
   }
 

test/cctest/wasm/test-run-wasm.cc

@@ -3083,6 +3083,47 @@ WASM_EXEC_TEST(CallIndirect_canonical) {
   CHECK_TRAP(r.Call(5));
 }
 
+WASM_EXEC_TEST(Regress_PushReturns) {
+  ValueType kSigTypes[] = {kWasmI32, kWasmI32, kWasmI32, kWasmI32,
+                           kWasmI32, kWasmI32, kWasmI32, kWasmI32,
+                           kWasmI32, kWasmI32, kWasmI32, kWasmI32};
+  FunctionSig sig(12, 0, kSigTypes);
+  WasmRunner<int32_t> r(execution_tier);
+
+  WasmFunctionCompiler& f1 = r.NewFunction(&sig);
+  BUILD(f1, WASM_I32V(1), WASM_I32V(2), WASM_I32V(3), WASM_I32V(4),
+        WASM_I32V(5), WASM_I32V(6), WASM_I32V(7), WASM_I32V(8), WASM_I32V(9),
+        WASM_I32V(10), WASM_I32V(11), WASM_I32V(12));
+
+  BUILD(r, WASM_CALL_FUNCTION0(f1.function_index()), WASM_DROP, WASM_DROP,
+        WASM_DROP, WASM_DROP, WASM_DROP, WASM_DROP, WASM_DROP, WASM_DROP,
+        WASM_DROP, WASM_DROP, WASM_DROP);
+  CHECK_EQ(1, r.Call());
+}
+
+WASM_EXEC_TEST(Regress_EnsureArguments) {
+  ValueType kSigTypes[] = {kWasmI32, kWasmI32, kWasmI32, kWasmI32,
+                           kWasmI32, kWasmI32, kWasmI32, kWasmI32,
+                           kWasmI32, kWasmI32, kWasmI32, kWasmI32};
+  FunctionSig sig(0, 12, kSigTypes);
+  WasmRunner<int32_t> r(execution_tier);
+
+  WasmFunctionCompiler& f2 = r.NewFunction(&sig);
+  BUILD(f2, kExprReturn);
+
+  BUILD(r, WASM_I32V(42), kExprReturn,
+        WASM_CALL_FUNCTION(f2.function_index(), WASM_I32V(1)));
+  CHECK_EQ(42, r.Call());
+}
+
+WASM_EXEC_TEST(Regress_PushControl) {
+  EXPERIMENTAL_FLAG_SCOPE(mv);
+  WasmRunner<int32_t> r(execution_tier);
+  BUILD(r, WASM_I32V(42),
+        WASM_IF(WASM_I32V(0), WASM_UNREACHABLE, kExprIf, kVoidCode, kExprEnd));
+  CHECK_EQ(42, r.Call());
+}
+
 WASM_EXEC_TEST(F32Floor) {
   WasmRunner<float, float> r(execution_tier);
   BUILD(r, WASM_F32_FLOOR(WASM_LOCAL_GET(0)));