[asm] Fix reusing code with annotated export info

For lazy compilation, we encode information about table exports in the
deoptimization data. This information is rebuilt on each instantiation,
so we need to reset it when reusing code objects from another instance.

R=ahaas@chromium.org
BUG=chromium:727219

Change-Id: I90557ef06e692d0a8323223cac26679efcfa408b
Reviewed-on: https://chromium-review.googlesource.com/517945Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45559}

src/wasm/wasm-module.cc

@@ -1416,10 +1416,16 @@ class InstantiationHelper {
         continue;
       }
       DCHECK_EQ(Builtins::kWasmCompileLazy, code->builtin_index());
-      if (code->deoptimization_data()->length() == 0) continue;
-      DCHECK_LE(2, code->deoptimization_data()->length());
+      int deopt_len = code->deoptimization_data()->length();
+      if (deopt_len == 0) continue;
+      DCHECK_LE(2, deopt_len);
       DCHECK_EQ(i, Smi::cast(code->deoptimization_data()->get(1))->value());
       code->deoptimization_data()->set(0, *weak_link);
+      // Entries [2, deopt_len) encode information about table exports of this
+      // function. This is rebuilt in {LoadTableSegments}, so reset it here.
+      for (int i = 2; i < deopt_len; ++i) {
+        code->deoptimization_data()->set_undefined(isolate_, i);
+      }
     }
 
     //--------------------------------------------------------------------------

test/mjsunit/regress/wasm/regression-727219.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --validate-asm
+
+function asm() {
+  "use asm";
+  function f(a) {
+    a = a | 0;
+    tab[a & 0]() | 0;
+  }
+  function unused() {
+    return 0;
+  }
+  var tab = [ unused ];
+  return f;
+}
+
+asm();
+gc();
+asm();