[asm.js] Test and fix function table type checks.

R=clemensh@chromium.org
TEST=message/asm-table-mismatch-[def|use]
BUG=v8:6202

Change-Id: I3e87f84591bedbda6366883a850dced149db0c8a
Reviewed-on: https://chromium-review.googlesource.com/471666Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44506}

src/asmjs/asm-parser.cc

@@ -706,6 +706,9 @@ void AsmJsParser::ValidateFunctionTable() {
       if (count >= static_cast<uint64_t>(table_info->mask) + 1) {
         FAIL("Exceeded function table size");
       }
+      if (!info->type->IsA(table_info->type)) {
+        FAIL("Function table definition doesn't match use");
+      }
       // Only store the function into a table if we used the table somewhere
       // (i.e. tables are first seen at their use sites and allocated there).
       module_builder_->SetIndirectFunction(

test/message/asm-table-mismatch-def.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --no-stress-opt --no-stress-validate-asm --no-suppress-asm-messages --fast-validate-asm
+
+// Violates asm.js {funTable} definition doesn't match the use in {f}.
+
+function Module() {
+  "use asm"
+  function f(a) {
+    a = a | 0;
+    a = funTable[a & 0](a | 0) | 0;
+    return a | 0;
+  }
+  function g() {
+    return 2.3;
+  }
+  var funTable = [ g ];
+  return { f:f };
+}
+Module().f();

test/message/asm-table-mismatch-def.out

+# Copyright 2017 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+*%(basename)s:19: Invalid asm.js: Function table definition doesn't match use

test/message/asm-table-mismatch-use.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --no-stress-opt --no-stress-validate-asm --no-suppress-asm-messages --fast-validate-asm
+
+// Violates asm.js {funTable} use in {f} doesn't match its use in {g}.
+
+function Module() {
+  "use asm"
+  function f(a) {
+    a = a | 0;
+    a = funTable[a & 0](a | 0) | 0;
+    return a | 0;
+  }
+  function g(a) {
+    a = a | 0;
+    a = funTable[a & 0](2.3) | 0;
+    return a | 0;
+  }
+  var funTable = [ f ];
+  return { f:f, g:g };
+}
+Module();

test/message/asm-table-mismatch-use.out

+# Copyright 2017 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+*%(basename)s:18: Invalid asm.js: Function use doesn't match definition