[asmjs] Validator should reject assignments to heap variables in functions.

BUG=chromium:617529

Review-Url: https://codereview.chromium.org/2041843002
Cr-Commit-Position: refs/heads/master@{#36747}

src/typing-asm.cc

@@ -682,6 +682,9 @@ void AsmTyper::VisitAssignment(Assignment* expr) {
     if (intish_ != 0) {
       FAIL(expr, "intish or floatish assignment");
     }
+    if (in_function_ && target_type->IsArray()) {
+      FAIL(expr, "assignment to array variable");
+    }
     expected_type_ = target_type;
     Variable* var = proxy->var();
     VariableInfo* info = GetVariableInfo(var);

test/mjsunit/regress/regress-617529.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function __f_71(stdlib, buffer) {
+  "use asm";
+  var __v_22 = new stdlib.Float64Array(buffer);
+  function __f_26() {
+    __v_22 = __v_22;
+  }
+  return {__f_26: __f_26};
+}
+
+assertThrows(function() { Wasm.instantiateModuleFromAsm( __f_71.toString()); });