Bug 855526 - Don't assert on busted asm.js modules with more than 3 arguments. r=luke.

--HG--
extra : rebase_source : 3d168e2bded38f499d563f00d0dcc245aa9d1a02

js/src/ion/AsmJSLink.cpp

@@ -395,20 +395,15 @@ HandleDynamicLinkFailure(JSContext *cx, CallArgs args, AsmJSModule &module, Hand
     // Call the function we just recompiled.
 
     unsigned argc = args.length();
-    JS_ASSERT(argc <= 3);
 
     InvokeArgsGuard args2;
-    if (!cx->stack.pushInvokeArgs(cx, args.length(), &args2))
+    if (!cx->stack.pushInvokeArgs(cx, argc, &args2))
         return false;
 
     args2.setCallee(ObjectValue(*fun));
     args2.setThis(args.thisv());
-    if (argc > 0)
-        args2[0] = args[0];
-    if (argc > 1)
-        args2[1] = args[1];
-    if (argc > 2)
-        args2[2] = args[2];
+    for (unsigned i = 0; i < argc; i++)
+        args2[i] = args[i];
 
     if (!Invoke(cx, args2))
         return false;

js/src/jit-test/tests/asm.js/bug855526.js

@@ -0,0 +1,13 @@
+// Don't assert.
+try {
+    eval('\
+    function asmModule(g, foreign, heap) {\
+        "use asm";\
+        let HEAP8 = new g.Int8Array(heap);\
+        function f() { return 17; } \
+        return {f: f};\
+    }\
+    let m = asmModule("", "", 1, "");\
+    ');
+} catch (ex) {
+}