[asm.js] Test and fix function table definition failures.

R=clemensh@chromium.org
BUG=v8:6127

Change-Id: I7f418b4e1accc8d560886cd5c05bdc54d3088249
Reviewed-on: https://chromium-review.googlesource.com/474864
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44586}

src/asmjs/asm-parser.cc

@@ -373,13 +373,13 @@ void AsmJsParser::ValidateModule() {
   RECURSE(ValidateExport());
 
   // Check that all functions were eventually defined.
-  for (auto info : global_var_info_) {
-    if (info.kind != VarKind::kFunction) {
-      continue;
-    }
-    if (!info.function_defined) {
+  for (auto& info : global_var_info_) {
+    if (info.kind == VarKind::kFunction && !info.function_defined) {
       FAIL("Undefined function");
     }
+    if (info.kind == VarKind::kTable && !info.function_defined) {
+      FAIL("Undefined function table");
+    }
   }
 
   // Add start function to init things.
@@ -689,7 +689,14 @@ void AsmJsParser::ValidateFunctionTable() {
     FAIL("Expected table name");
   }
   VarInfo* table_info = GetVarInfo(Consume());
-  // TODO(bradnelson): Check for double use of export name.
+  if (table_info->kind == VarKind::kTable) {
+    if (table_info->function_defined) {
+      FAIL("Function table redefined");
+    }
+    table_info->function_defined = true;
+  } else if (table_info->kind != VarKind::kUnused) {
+    FAIL("Function table name collides");
+  }
   EXPECT_TOKEN('=');
   EXPECT_TOKEN('[');
   uint64_t count = 0;
@@ -701,6 +708,8 @@ void AsmJsParser::ValidateFunctionTable() {
     if (info->kind != VarKind::kFunction) {
       FAIL("Expected function");
     }
+    // Only store the function into a table if we used the table somewhere
+    // (i.e. tables are first seen at their use sites and allocated there).
     if (table_info->kind == VarKind::kTable) {
       DCHECK_GE(table_info->mask, 0);
       if (count >= static_cast<uint64_t>(table_info->mask) + 1) {
@@ -709,8 +718,6 @@ void AsmJsParser::ValidateFunctionTable() {
       if (!info->type->IsA(table_info->type)) {
         FAIL("Function table definition doesn't match use");
       }
-      // Only store the function into a table if we used the table somewhere
-      // (i.e. tables are first seen at their use sites and allocated there).
       module_builder_->SetIndirectFunction(
           static_cast<uint32_t>(table_info->index + count), info->index);
     }

test/message/asm-function-undefined.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --no-stress-opt --no-stress-validate-asm --no-suppress-asm-messages --fast-validate-asm
+
+function Module() {
+  "use asm"
+  function f() {
+    g();
+  }
+  return { f:f };
+}
+Module();

test/message/asm-function-undefined.out

+# Copyright 2017 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+*%(basename)s:12: Invalid asm.js: Undefined function

test/message/asm-table-redefined.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --no-stress-opt --no-stress-validate-asm --no-suppress-asm-messages --fast-validate-asm
+
+function Module() {
+  "use asm"
+  function f(a) {
+    a = a | 0;
+    funTable[a & 0](a | 0);
+  }
+  function g(a) {
+    a = a | 0;
+  }
+  var funTable = [ f ];
+  var funTable = [ g ];
+  return { f:f };
+}
+Module().f();

test/message/asm-table-redefined.out

+# Copyright 2017 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+*%(basename)s:17: Invalid asm.js: Function table redefined

test/message/asm-table-undefined.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --no-stress-opt --no-stress-validate-asm --no-suppress-asm-messages --fast-validate-asm
+
+function Module() {
+  "use asm"
+  function f(a) {
+    a = a | 0;
+    funTable[a & 0](a | 0);
+  }
+  return { f:f };
+}
+Module();

test/message/asm-table-undefined.out

+# Copyright 2017 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+*%(basename)s:13: Invalid asm.js: Undefined function table

test/message/asm-table-variable-collision.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --no-stress-opt --no-stress-validate-asm --no-suppress-asm-messages --fast-validate-asm
+
+function Module() {
+  "use asm"
+  var funTable = 0;
+  function f() {}
+  var funTable = [ f ];
+  return { f:f };
+}
+Module();

test/message/asm-table-variable-collision.out

+# Copyright 2017 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+*%(basename)s:11: Invalid asm.js: Function table name collides