All of this is controlled by the CallDescriptor. It's simply the case
that if you specify less registers than the function arity calls for,
the rest are assumed to be on the stack.

Bailout handlers accept these constant stack arguments too.

BUG=

Review URL: https://codereview.chromium.org/1250563004

Cr-Commit-Position: refs/heads/master@{#29813}