[asm.js] Fix fall-back case in MultiplicativeExpression.

This fixes the fall-back case when parsing a multiplicative expression
where the lookahead found a '-' token followed by an unsigned token, but
no '*' token is following. We cannot rewind both tokens, but still need
to make sure that a full multiplicative expression is parsed.

R=clemensh@chromium.org
TEST=mjsunit/regress/regress-8377
BUG=v8:8377

Change-Id: I20ce6267445b32bdaf03f41f11d9ef4be66cb636
Reviewed-on: https://chromium-review.googlesource.com/c/1304317Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57084}

src/asmjs/asm-parser.cc

@@ -1642,6 +1642,7 @@ AsmType* AsmJsParser::UnaryExpression() {
 
 // 6.8.8 MultiplicativeExpression
 AsmType* AsmJsParser::MultiplicativeExpression() {
+  AsmType* a;
   uint32_t uvalue;
   if (CheckForUnsignedBelow(0x100000, &uvalue)) {
     if (Check('*')) {
@@ -1654,8 +1655,10 @@ AsmType* AsmJsParser::MultiplicativeExpression() {
       current_function_builder_->EmitI32Const(value);
       current_function_builder_->Emit(kExprI32Mul);
       return AsmType::Intish();
-    }
+    } else {
       scanner_.Rewind();
+      RECURSEn(a = UnaryExpression());
+    }
   } else if (Check('-')) {
     if (CheckForUnsignedBelow(0x100000, &uvalue)) {
       int32_t value = -static_cast<int32_t>(uvalue);
@@ -1669,12 +1672,14 @@ AsmType* AsmJsParser::MultiplicativeExpression() {
         current_function_builder_->Emit(kExprI32Mul);
         return AsmType::Intish();
       }
-      return AsmType::Signed();
-    }
+      a = AsmType::Signed();
+    } else {
       scanner_.Rewind();
+      RECURSEn(a = UnaryExpression());
     }
-  AsmType* a;
+  } else {
     RECURSEn(a = UnaryExpression());
+  }
   for (;;) {
     if (Check('*')) {
       uint32_t uvalue;

test/mjsunit/regress/regress-8377.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Module(global, env, buffer) {
+  "use asm";
+  function test1() {
+    var x = 0;
+    x = -1 / 1 | 0;
+    return x | 0;
+  }
+  function test2() {
+    var x = 0;
+    x = (-1 / 1) | 0;
+    return x | 0;
+  }
+  return { test1: test1, test2: test2 };
+};
+let module = Module(this);
+assertEquals(-1, module.test1());
+assertEquals(-1, module.test2());
+assertTrue(%IsAsmWasmCode(Module));