[wasm] throw in case of assignment to module parameters

BUG=613928
R=bradnelson@chromium.org
TEST=regress-613928.js

Review-Url: https://codereview.chromium.org/2123283007
Cr-Commit-Position: refs/heads/master@{#37653}

src/asmjs/typing-asm.cc

@@ -675,6 +675,9 @@ void AsmTyper::VisitAssignment(Assignment* expr) {
     }
     expected_type_ = target_type;
     Variable* var = proxy->var();
+    if (!in_function_ && var->IsParameter()) {
+      FAIL(expr, "assignment to module parameter");
+    }
     VariableInfo* info = GetVariableInfo(var);
     if (info == nullptr || info->type == nullptr) {
       if (var->mode() == TEMPORARY) {

test/mjsunit/regress/regress-613928.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+(function __f_54() {
+  function __f_41(stdlib, __v_35) {
+    "use asm";
+    __v_35 = __v_35;
+    function __f_21(int_val, double_val) {
+      int_val = int_val|0;
+      double_val = +double_val;
+    }
+    return {__f_21:__f_21};
+  }
+  assertThrows(function() {Wasm.instantiateModuleFromAsm(__f_41.toString())});
+})();