[asm.js] Add stress mode for the asm.js validator.

This adds a --stress-validate-asm flag intended to stress test the
validator by running against every single function, independent of
whether a "use asm" directive is present. It mainly tests negative
cases because barely any function in our test corpus will be a valid
module according to the asm.js spec.

R=bradnelson@chromium.org
BUG=v8:6127

Change-Id: Id04b0440628134d4e81c9bb4d71039f940fc9a83
Reviewed-on: https://chromium-review.googlesource.com/457039Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44055}

src/compiler.cc

@@ -383,8 +383,21 @@ bool ShouldUseIgnition(CompilationInfo* info) {
 
 bool UseAsmWasm(DeclarationScope* scope, Handle<SharedFunctionInfo> shared_info,
                 bool is_debug) {
-  return FLAG_validate_asm && scope->asm_module() &&
-         !shared_info->is_asm_wasm_broken() && !is_debug;
+  // Check whether asm.js validation is enabled.
+  if (!FLAG_validate_asm) return false;
+
+  // Modules that have validated successfully, but were subsequently broken by
+  // invalid module instantiation attempts are off limit forever.
+  if (shared_info->is_asm_wasm_broken()) return false;
+
+  // Compiling for debugging is not supported, fall back.
+  if (is_debug) return false;
+
+  // In stress mode we want to run the validator on everything.
+  if (FLAG_stress_validate_asm) return true;
+
+  // In general, we respect the "use asm" directive.
+  return scope->asm_module();
 }
 
 bool UseCompilerDispatcher(Compiler::ConcurrencyMode inner_function_mode,

src/flag-definitions.h

@@ -552,6 +552,7 @@ DEFINE_BOOL(suppress_asm_messages, false,
 DEFINE_BOOL(trace_asm_time, false, "log asm.js timing info to the console")
 DEFINE_BOOL(trace_asm_scanner, false,
             "log tokens encountered by asm.js scanner")
+DEFINE_BOOL(stress_validate_asm, false, "try to validate everything as asm.js")
 
 DEFINE_BOOL(dump_wasm_module, false, "dump WASM module bytes")
 DEFINE_STRING(dump_wasm_module_path, NULL, "directory to dump wasm modules to")

test/message/message.status

@@ -36,4 +36,11 @@
   # tested standalone.
   'modules-skip*': [SKIP],
 }],  # ALWAYS
+
+##############################################################################
+['variant == asm_wasm', {
+  '*': [SKIP],
+}],  # variant == asm_wasm
+
+##############################################################################
 ]

test/mjsunit/mjsunit.status

@@ -660,6 +660,14 @@
 
 ##############################################################################
 ['variant == asm_wasm', {
+  # Issue 6127: We won't fix these in the "old" validator. But we definitely
+  # need to re-enable these for the "new" validator.
+  'code-coverage-precise': [SKIP],
+  'object-freeze': [SKIP],
+  'regress/regress-599068-func-bindings': [SKIP],
+  'regress/regress-619382': [SKIP],
+  'regress/regress-632289': [SKIP],
+
   # Skip stuff uninteresting for asm.js
   'bugs/*': [SKIP],
   'compiler/*': [SKIP],

tools/testrunner/local/variants.py

@@ -12,7 +12,7 @@ ALL_VARIANT_FLAGS = {
   "noturbofan_stress": [["--no-turbo", "--stress-opt", "--always-opt"]],
   "fullcode": [["--nocrankshaft", "--no-turbo"]],
   "nooptimization": [["--nocrankshaft", "--turbo-filter=~"]],
-  "asm_wasm": [["--validate-asm"]],
+  "asm_wasm": [["--validate-asm", "--stress-validate-asm"]],
   "wasm_traps": [["--wasm_guard_pages", "--wasm_trap_handler", "--invoke-weak-callbacks"]],
 }
 
@@ -25,7 +25,7 @@ FAST_VARIANT_FLAGS = {
   "noturbofan_stress": [["--no-turbo", "--stress-opt"]],
   "fullcode": [["--nocrankshaft", "--no-turbo"]],
   "nooptimization": [["--nocrankshaft", "--turbo-filter=~"]],
-  "asm_wasm": [["--validate-asm"]],
+  "asm_wasm": [["--validate-asm", "--stress-validate-asm"]],
   "wasm_traps": [["--wasm_guard_pages", "--wasm_trap_handler", "--invoke-weak-callbacks"]],
 }