[wasm] Fix asm.js module instantiation on retry.

This fixes the case where a module is instantiated twice via the same
closure when in the meantime another closure has destroyed and removed
the WASM data attached to the SharedFunctionInfo.

R=bradnelson@chromium.org
TEST=mjsunit/asm/asm-validation
BUG=v8:4203

Review-Url: https://codereview.chromium.org/2253613004
Cr-Commit-Position: refs/heads/master@{#38696}

src/runtime/runtime-compiler.cc

@@ -93,7 +93,7 @@ RUNTIME_FUNCTION(Runtime_InstantiateAsmJs) {
   if (args[3]->IsJSArrayBuffer()) {
     memory = args.at<i::JSArrayBuffer>(3);
   }
-  if (args[1]->IsJSObject()) {
+  if (args[1]->IsJSObject() && function->shared()->HasAsmWasmData()) {
     MaybeHandle<Object> result;
     result = AsmJs::InstantiateAsmWasm(
         isolate, handle(function->shared()->asm_wasm_data()), memory, foreign);
@@ -103,7 +103,9 @@ RUNTIME_FUNCTION(Runtime_InstantiateAsmJs) {
   }
   // Remove wasm data, mark as broken for asm->wasm,
   // replace code with CompileLazy, and return a smi 0 to indicate failure.
-  function->shared()->ClearAsmWasmData();
+  if (function->shared()->HasAsmWasmData()) {
+    function->shared()->ClearAsmWasmData();
+  }
   function->shared()->set_is_asm_wasm_broken(true);
   DCHECK(function->code() ==
          isolate->builtins()->builtin(Builtins::kInstantiateAsmJs));

test/mjsunit/asm/asm-validation.js

@@ -174,6 +174,29 @@ function IsAlwaysOpt(module) {
   assertEquals(123, m2.foo());
 })();
 
+(function TestSuccessThenFailureThenRetry() {
+  function MkModule() {
+    function Module(stdlib, ffi, heap) {
+      "use asm";
+      function foo() { return 123; }
+      return { foo: foo };
+    }
+    return Module;
+  }
+  var Module1 = MkModule();
+  var Module2 = MkModule();
+  var heap = new ArrayBuffer(1024 * 1024);
+  var m1a = Module1({}, {}, heap);
+  assertTrue(%IsAsmWasmCode(Module1) || IsAlwaysOpt(Module1));
+  var m2 = Module2(1, 2, 3);
+  assertFalse(%IsAsmWasmCode(Module2));
+  var m1b = Module1({}, {}, heap);
+  assertFalse(%IsAsmWasmCode(Module1));
+  assertEquals(123, m1a.foo());
+  assertEquals(123, m1b.foo());
+  assertEquals(123, m2.foo());
+})();
+
 (function TestBoundFunction() {
   function Module(stdlib, ffi, heap) {
     "use asm";