[asm.js] Test and fix function type checking.

R=ahaas@chromium.org
TEST=message/asm-function-mismatch-def
BUG=v8:6208

Change-Id: I415281d63bb376da3220ba31bbdf0b3d60e03299
Reviewed-on: https://chromium-review.googlesource.com/469947
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44482}

src/asmjs/asm-parser.cc

@@ -798,22 +798,18 @@ void AsmJsParser::ValidateFunction() {
   // End function
   current_function_builder_->Emit(kExprEnd);
 
-  // Add in function type.
+  // Record (or validate) function type.
   AsmType* function_type = AsmType::Function(zone(), return_type_);
   for (auto t : params) {
     function_type->AsFunctionType()->AddArgument(t);
   }
   function_info = GetVarInfo(function_name);
-  if (function_info->kind == VarKind::kUnused) {
-    function_info->kind = VarKind::kFunction;
-    function_info->index = current_function_builder_->func_index();
+  if (function_info->type->IsA(AsmType::None())) {
+    DCHECK(function_info->kind == VarKind::kFunction);
     function_info->type = function_type;
-  } else {
+  } else if (!function_type->IsA(function_info->type)) {
     // TODO(bradnelson): Should IsExactly be used here?
-    if (!function_info->type->IsA(AsmType::None()) &&
-        !function_type->IsA(function_info->type)) {
-      FAIL("Function definition doesn't match use");
-    }
+    FAIL("Function definition doesn't match use");
   }
 
   scanner_.ResetLocals();

test/message/asm-function-mismatch-def.js

@@ -0,0 +1,19 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --no-stress-opt --no-stress-validate-asm --no-suppress-asm-messages --fast-validate-asm
+
+// Violates asm.js because use of {g} in {f} has return type different from {g}.
+
+function Module() {
+  "use asm"
+  function g() {
+    return 2.3;
+  }
+  function f() {
+    return g() | 0;
+  }
+  return { f:f };
+}
+Module().f();

test/message/asm-function-mismatch-def.out

@@ -0,0 +1,5 @@
+# Copyright 2017 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+*%(basename)s:15: Invalid asm.js: Function use doesn't match definition

test/message/asm-function-mismatch-use.js

@@ -0,0 +1,19 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --no-stress-opt --no-stress-validate-asm --no-suppress-asm-messages --fast-validate-asm
+
+// Violates asm.js because {g} has return type different from use of {g} in {f}.
+
+function Module() {
+  "use asm"
+  function f() {
+    return g() | 0;
+  }
+  function g() {
+    return 2.3;
+  }
+  return { f:f };
+}
+Module().f();

test/message/asm-function-mismatch-use.out

@@ -0,0 +1,5 @@
+# Copyright 2017 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+*%(basename)s:17: Invalid asm.js: Function definition doesn't match use