[wasm][asm.js] Check if a property key is a PropertyName before assumming it.

BUG=681707
R=aseemgarg@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2641513003
Cr-Commit-Position: refs/heads/master@{#42433}

src/asmjs/asm-typer.cc

@@ -385,6 +385,10 @@ AsmTyper::VariableInfo* AsmTyper::ImportLookup(Property* import) {
     return obj_info;
   }
 
+  if (!key->IsPropertyName()) {
+    return nullptr;
+  }
+
   std::unique_ptr<char[]> aname = key->AsPropertyName()->ToCString();
   ObjectTypeMap::iterator i = stdlib->find(std::string(aname.get()));
   if (i == stdlib->end()) {

test/mjsunit/asm/regress-681707.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm
+
+var foo = (function(stdlib) {
+  "use asm";
+  var bar = (stdlib[0]);
+  function foo() { return bar ("lala"); }
+  return foo;
+})(this);
+
+try {
+  nop(foo);
+  foo();
+} catch (e) {
+}