Only allow |0 and *1.0 for asm validator foreign variables.

src/typing-asm.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/typing-asm.h"
 
 #include <limits>
 
 #include "src/v8.h"
 
@@ skipping 1103 matching lines @@
 
 void AsmTyper::VisitBinaryOperation(BinaryOperation* expr) {
   if (!in_function_) {
     if (expr->op() != Token::BIT_OR && expr->op() != Token::MUL) {
       FAIL(expr, "illegal binary operator inside module body");
     }
     if (!(expr->left()->IsProperty() || expr->left()->IsVariableProxy()) ||
         !expr->right()->IsLiteral()) {
       FAIL(expr, "illegal computation inside module body");
     }
+    DCHECK(expr->right()->AsLiteral() != nullptr);
+    const AstValue* right_value = expr->right()->AsLiteral()->raw_value();
+    if (expr->op() == Token::BIT_OR) {
+      if (right_value->AsNumber() != 0.0 || right_value->ContainsDot()) {
+        FAIL(expr, "illegal integer annotation value");
+      }
+    }
+    if (expr->op() == Token::MUL) {
+      if (right_value->AsNumber() != 1.0 && right_value->ContainsDot()) {
+        FAIL(expr, "illegal double annotation value");
+      }
+    }
   }
   switch (expr->op()) {
     case Token::COMMA: {
       RECURSE(VisitWithExpectation(expr->left(), Type::Any(),
                                    "left comma operand expected to be any"));
       RECURSE(VisitWithExpectation(expr->right(), Type::Any(),
                                    "right comma operand expected to be any"));
       IntersectResult(expr, computed_type_);
       return;
     }
@@ skipping 401 matching lines @@
 
 
 void AsmTyper::VisitRewritableAssignmentExpression(
     RewritableAssignmentExpression* expr) {
   RECURSE(Visit(expr->expression()));
 }
 
 
 }  // namespace internal
 }  // namespace v8