[asmjs] Validator should reject assignments to heap variables in functions.

src/typing-asm.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/typing-asm.h"
 
 #include <limits>
 
 #include "src/v8.h"
 
@@ skipping 664 matching lines @@
   RECURSE(VisitWithExpectation(
       expr->value(), type, "assignment value expected to match surrounding"));
   Type* target_type = StorageType(computed_type_);
 
   if (expr->target()->IsVariableProxy()) {
     // Assignment to a local or context variable.
     VariableProxy* proxy = expr->target()->AsVariableProxy();
     if (intish_ != 0) {
       FAIL(expr, "intish or floatish assignment");
     }
+    if (in_function_ && target_type->IsArray()) {
+      FAIL(expr, "assignment to array variable");
+    }
     expected_type_ = target_type;
     Variable* var = proxy->var();
     VariableInfo* info = GetVariableInfo(var);
     if (info == nullptr || info->type == nullptr) {
       if (var->mode() == TEMPORARY) {
         SetType(var, Type::Any());
         info = GetVariableInfo(var);
       } else {
         FAIL(proxy, "unbound variable");
       }
@@ skipping 935 matching lines @@
 }
 
 
 void AsmTyper::VisitRewritableExpression(RewritableExpression* expr) {
   RECURSE(Visit(expr->expression()));
 }
 
 
 }  // namespace internal
 }  // namespace v8