[Interpreter] Fixes PushArgsAndConstruct builtin to not store any data outside esp.

In ia32 PushArgsAndConstruct builtin, we run out of registers and need to
temporarily store the data in the stack. In the earlier implementation,
a location outside the esp was used. This causes a problem if there is a
interrupt/signals which would use the same stack and corrupt the data that
is above the esp. This cl fixes it by pushing it onto the stack so that
the stack pointer is updated and hence the corruption will not happen. We
reuse the slot meant for receiver as a temporary store.

TBR=rmcilroy@chromium.org
BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1750373002

Cr-Commit-Position: refs/heads/master@{#34397}

src/ia32/builtins-ia32.cc

@@ -602,27 +602,24 @@ void Builtins::Generate_InterpreterPushArgsAndConstruct(MacroAssembler* masm) {
   //           they are to be pushed onto the stack.
   // -----------------------------------
 
-  // Save number of arguments on the stack below where arguments are going
-  // to be pushed.
-  __ mov(ecx, eax);
-  __ neg(ecx);
-  __ mov(Operand(esp, ecx, times_pointer_size, -kPointerSize), eax);
-  __ mov(eax, ecx);
-
   // Pop return address to allow tail-call after pushing arguments.
   __ Pop(ecx);
 
-  // Find the address of the last argument.
-  __ shl(eax, kPointerSizeLog2);
-  __ add(eax, ebx);
+  // Push edi in the slot meant for receiver. We need an extra register
+  // so store edi temporarily on stack.
+  __ Push(edi);
 
-  // Push padding for receiver.
-  __ Push(Immediate(0));
+  // Find the address of the last argument.
+  __ mov(edi, eax);
+  __ neg(edi);
+  __ shl(edi, kPointerSizeLog2);
+  __ add(edi, ebx);
 
-  Generate_InterpreterPushArgs(masm, eax);
+  Generate_InterpreterPushArgs(masm, edi);
 
-  // Restore number of arguments from slot on stack.
-  __ mov(eax, Operand(esp, -kPointerSize));
+  // Restore the constructor from slot on stack. It was pushed at the slot
+  // meant for receiver.
+  __ mov(edi, Operand(esp, eax, times_pointer_size, 0));
 
   // Re-push return address.
   __ Push(ecx);

test/cctest/cctest.status

@@ -558,8 +558,6 @@
   'test-run-inlining/InlineTwice': [FAIL],
   'test-serialize/SerializeInternalReference': [FAIL, ['arch == arm or arch == arm64', PASS]],
 
-  # TODO(mythria,4680): This is flaky for ia32. Sometimes crashes. Skipping for now.
-  'test-cpu-profiler/SampleWhenFrameIsNotSetup': [SKIP],
 }],  # ignition == True
 
 ]