ArityFixup should adjust SP first

ArityFixup should adjust SP first
https://bugs.webkit.org/show_bug.cgi?id=167239

Reviewed by Michael Saboff.

JSTests:

Significantly large arity fixup reliably causes this crash.

* stress/arity-fixup-should-not-touch-stack-area-below-sp.js: Added.

Source/JavaScriptCore:

Arity fixup extends the stack and copy/fill the stack with
the values. At that time, we accidentally read/write stack
space below the stack pointer. As a result, we touch the area
of the stack space below the x64 red zone. These areas are unsafe.
OS may corrupt this space when constructing a signal stack.
The Linux kernel could not populate the pages for this space
and causes segmentation fault. This patch changes the stack
pointer before performing the arity fixup.

* jit/ThunkGenerators.cpp:
(JSC::arityFixupGenerator):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@211479 268f45cc-cd09-0410-ab3c-d52691b4dbfc