[asm.js] Exported functions diverge from wasm js-api spec.

The WebAssembly JavaScript Interface specifies[1] that exported
functions are not constructors, hence do not have the "prototype"
property. This is not true for asm.js exported functions which are
expected to look like normal functions (or constructors).

[1] https://webassembly.github.io/spec/js-api/index.html#exported-function-exotic-objects

R=clemensh@chromium.org
TEST=mjsunit/regress/regress-crbug-935800
BUG=chromium:935800

Change-Id: Idecacfb7f5d4668540589af95fd59872334c21a3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1578499
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60943}

src/wasm/wasm-objects.cc

@@ -1915,12 +1915,16 @@ Handle<WasmExportedFunction> WasmExportedFunction::New(
                    Vector<uint8_t>::cast(buffer.SubVector(0, length)))
                .ToHandleChecked();
   }
-  NewFunctionArgs args = NewFunctionArgs::ForWasm(
-      name, function_data, isolate->sloppy_function_without_prototype_map());
+  bool is_asm_js_module = instance->module_object()->is_asm_js();
+  Handle<Map> function_map =
+      is_asm_js_module ? isolate->sloppy_function_map()
+                       : isolate->sloppy_function_without_prototype_map();
+  NewFunctionArgs args =
+      NewFunctionArgs::ForWasm(name, function_data, function_map);
   Handle<JSFunction> js_function = isolate->factory()->NewFunction(args);
   // According to the spec, exported functions should not have a [[Construct]]
-  // method.
-  DCHECK(!js_function->IsConstructor());
+  // method. This does not apply to functions exported from asm.js however.
+  DCHECK_EQ(is_asm_js_module, js_function->IsConstructor());
   js_function->shared()->set_length(arity);
   js_function->shared()->set_internal_formal_parameter_count(arity);
   return Handle<WasmExportedFunction>::cast(js_function);

test/mjsunit/regress/regress-crbug-935800.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo() {
+  "use asm";
+  function bar() {}
+  return {bar: bar};
+}
+var module = foo();
+assertTrue(Object.getOwnPropertyNames(module.bar).includes("prototype"));
+assertInstanceof(new module.bar(), module.bar);

tools/clusterfuzz/v8_sanity_checks.js

@@ -17,6 +17,5 @@ print("https://crbug.com/935800");
     function baz() {}
     return {bar: baz};
   }
-  // TODO(mstarzinger): Uncomment once https://crbug.com/935800 is resolved.
-  // print(Object.getOwnPropertyNames(foo().bar));
+  print(Object.getOwnPropertyNames(foo().bar));
 })();