[wasm][asm.js] Fix and enable several asm.js tests with the new parser.

src/wasm/wasm-module-builder.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/signature.h"
 
 #include "src/handles.h"
 #include "src/objects-inl.h"
 #include "src/v8.h"
 #include "src/zone/zone-containers.h"
@@ skipping 173 matching lines @@
   asm_func_start_source_position_ = position;
   last_asm_source_position_ = position;
 }
 
 void WasmFunctionBuilder::StashCode(std::vector<byte>* dst, size_t position) {
   if (dst == nullptr) {
     body_.resize(position);
     return;
   }
   size_t len = body_.size() - position;
+  if (len == 0) {
+    // TODO(bradnelson): Figure out why the memcpy crashes if len == 0.

[Michael Starzinger, 2017/03/24 11:56:05]

It is not the memcpy that crashes but the accessor to body_[position] if
position == body_.size(). This is an out-of-bounds access. I think the early
return is the best fix for this case.

On a related note, what about the case where position > body_.size()? Do we care
about this case? Could we add a DCHECK_LE(position, body_.size()) into this
method?

[bradnelson, 2017/03/28 04:34:31]

Done.

+    return;
+  }
   dst->resize(len);
   memcpy(dst->data(), &body_[position], len);
   body_.resize(position);
 }
 
 void WasmFunctionBuilder::WriteSignature(ZoneBuffer& buffer) const {
   buffer.write_u32v(signature_index_);
 }
 
 void WasmFunctionBuilder::WriteExports(ZoneBuffer& buffer) const {
@@ skipping 383 matching lines @@
   // Emit the offset table per function.
   for (auto function : functions_) {
     function->WriteAsmWasmOffsetTable(buffer);
   }
   // Append a 0 to indicate that this is an encoded table.
   buffer.write_u8(0);
 }
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8