[asm.js] Fix assignment with undeclared target.

R=clemensh@chromium.org
BUG=v8:6127

Change-Id: I32d2a36cdc2a65c3e0016e49157524573755d09d
Reviewed-on: https://chromium-review.googlesource.com/461185
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44260}

src/asmjs/asm-parser.cc

@@ -1496,8 +1496,11 @@ AsmType* AsmJsParser::AssignmentExpression() {
     ret = info->type;
     scanner_.Next();
     if (Check('=')) {
-      // NOTE: Before this point, this might have been VarKind::kUndefined,
-      // as it might be a label.
+      // NOTE: Before this point, this might have been VarKind::kUnused even in
+      // valid code, as it might be a label.
+      if (info->kind == VarKind::kUnused) {
+        FAILn("Undeclared assignment target");
+      }
       DCHECK(is_local ? info->kind == VarKind::kLocal
                       : info->kind == VarKind::kGlobal);
       AsmType* value;

test/message/asm-assignment-undeclared.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --no-stress-opt --no-stress-validate-asm --no-suppress-asm-messages --fast-validate-asm
+
+function Module() {
+  "use asm"
+  function f(a) {
+    a = a | 0;
+    b = (a + 23) | 0;
+    return b | 0;
+  }
+  return { f:f };
+}
+Module().f();

test/message/asm-assignment-undeclared.out

+# Copyright 2017 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+*%(basename)s:11: Invalid asm.js: Undeclared assignment target

test/mjsunit/mjsunit.status

@@ -659,7 +659,6 @@
 ['variant == asm_wasm', {
   # Issue 6127: We won't fix these in the "old" validator. But we definitely
   # need to re-enable these for the "new" validator.
-  'compiler/regress-452427': [SKIP],
   'regress/regress-599719': [SKIP],
   'regress/regress-618608': [SKIP],
   'regress/regress-670808': [SKIP],