[asmjs] Validator should reject assignments to heap variables in functions.

src/typing-asm.cc

Index: src/typing-asm.cc
diff --git a/src/typing-asm.cc b/src/typing-asm.cc
index d98998520fae35bbc16c305979a6123df1be0cd7..df80c8ca0a7471739b6b407eed3f8b8619dd87f0 100644
--- a/src/typing-asm.cc
+++ b/src/typing-asm.cc
@@ -682,6 +682,9 @@ void AsmTyper::VisitAssignment(Assignment* expr) {
     if (intish_ != 0) {
       FAIL(expr, "intish or floatish assignment");
     }
+    if (in_function_ && target_type->IsArray()) {
+      FAIL(expr, "assignment to array variable");
+    }
     expected_type_ = target_type;
     Variable* var = proxy->var();
     VariableInfo* info = GetVariableInfo(var);