V8. ASM-2-WASM. Validator V2.

src/wasm/asm-typer.cc

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/wasm/asm-typer.h"
+
+#include <limits>
+#include <string>
+
+#include "src/v8.h"
+
+#include "src/ast/ast.h"
+#include "src/ast/scopes.h"
+#include "src/base/bits.h"
+#include "src/codegen.h"
+#include "src/type-cache.h"
+#include "src/wasm/asm-types.h"
+
+#ifndef DEBUG
+
+#define FAIL(node, msg)                                        \
+  do {                                                         \
+    int line = node->position() == RelocInfo::kNoPosition      \
+                   ? -1                                        \
+                   : script_->GetLineNumber(node->position()); \
+    base::OS::SNPrintF(error_message_, sizeof(error_message_), \
+                       "asm: line %d: %s\n", line + 1, msg);   \
+    return AsmType::None();                                    \
+  } while (false)
+
+#else  // defined(DEBUG)
+
+#define FAIL(node, msg)                                        \
+  do {                                                         \
+    int line = node->position() == RelocInfo::kNoPosition      \
+                   ? -1                                        \
+                   : script_->GetLineNumber(node->position()); \
+    base::OS::SNPrintF(error_message_, sizeof(error_message_), \
+                       "asm: line %d: %s\n", line + 1, msg);   \
+    /*(node)->Print(isolate_);*/                               \
+    return AsmType::None();                                    \
+  } while (false)
+
+#endif  // DEBUG
+
+#define RECURSE(call)                \

[bradnelson, 2016/06/24 00:19:00]

Put a TODO in about adding the stack checks.

[John, 2016/06/24 17:47:57]

Done.

+  do {                               \
+    if ((call) == AsmType::None()) { \
+      return AsmType::None();        \
+    }                                \
+  } while (false)
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+
+using v8::internal::AstNode;
+
+// ----------------------------------------------------------------------------
+// Implementation of AsmTyper::FlattenedStatements
+
+AsmTyper::FlattenedStatements::FlattenedStatements(Zone* zone,
+                                                   ZoneList<Statement*>* s)
+    : context_stack_(zone) {
+  context_stack_.emplace_back(Context(s));
+}
+
+Statement* AsmTyper::FlattenedStatements::Next() {
+  for (;;) {
+    if (context_stack_.empty()) {
+      return nullptr;
+    }
+
+    Context* current = &context_stack_.back();
+
+    if (current->statements_->length() <= current->next_index_) {
+      context_stack_.pop_back();
+      continue;
+    }
+
+    Statement* current_statement =
+        current->statements_->at(current->next_index_++);
+    if (current_statement->IsBlock()) {
+      context_stack_.emplace_back(
+          Context(current_statement->AsBlock()->statements()));
+      continue;
+    }
+
+    return current_statement;
+  }
+}
+
+// ----------------------------------------------------------------------------
+// Implementation of AsmTyper::VariableInfo
+
+AsmTyper::VariableInfo* AsmTyper::VariableInfo::Clone(Zone* zone) const {
+  CHECK(standard_member_ != kNone);
+  auto* new_var_info = new (zone) VariableInfo(type_);
+  new_var_info->standard_member_ = standard_member_;
+  new_var_info->mutability_ = mutability_;
+  return new_var_info;
+}
+
+void AsmTyper::VariableInfo::FirstForwardUseIs(VariableProxy* var) {
+  missing_definition_ = true;
+  first_forward_use_ = var;

[bradnelson, 2016/06/24 00:19:00]

Assert only set once?

[John, 2016/06/24 17:47:56]

Done.

+}
+
+// ----------------------------------------------------------------------------
+// Implementation of AsmTyper
+
+AsmTyper::AsmTyper(Isolate* isolate, Zone* zone, Script* script,
+                   FunctionLiteral* root)
+    : isolate_(isolate),
+      zone_(zone),
+      script_(script),
+      root_(root),
+      forward_definitions_(zone),
+      stdlib_types_(zone),
+      stdlib_math_types_(zone),
+      global_scope_(ZoneHashMap::PointersMatch,
+                    ZoneHashMap::kDefaultHashMapCapacity,
+                    ZoneAllocationPolicy(zone)),
+      local_scope_(ZoneHashMap::PointersMatch,
+                   ZoneHashMap::kDefaultHashMapCapacity,
+                   ZoneAllocationPolicy(zone)) {
+  (void)isolate_;

[bradnelson, 2016/06/24 00:19:00]

Space in between cast. (Which compiler catches this as unused?)

[John, 2016/06/24 17:47:58]

LLVM was complaining locally. It stopped -- maybe because of the "friend"
declaration? removed.

+  InitializeStdlib();
+  module_info_.set_standard_member(kModule);
+}
+
+namespace {
+bool ValidAsmIdentifier(Handle<String> name) {
+  static const char* kInvalidAsmNames[] = {"eval", "arguments"};

[bradnelson, 2016/06/24 00:19:03]

Ooh didn't catch these!. Nice

[John, 2016/06/24 17:47:58]

Acknowledged.

+
+  for (size_t ii = 0; ii < arraysize(kInvalidAsmNames); ++ii) {
+    if (strcmp(name->ToCString().get(), kInvalidAsmNames[ii]) == 0) {
+      return false;
+    }
+  }
+  return true;
+}
+}  // namespace
+
+void AsmTyper::InitializeStdlib() {
+  auto* d = AsmType::Double();
+  auto* dq = AsmType::DoubleQ();
+  auto* dq2d = AsmType::Function(zone_, d);
+  dq2d->AsFunctionType()->AddArgument(dq);
+  auto* dqdq2d = AsmType::Function(zone_, d);
+  dqdq2d->AsFunctionType()->AddArgument(dq);

[bradnelson, 2016/06/24 00:19:01]

Worth having a helper in asm-types.h to make 1/2 arg functions?
Or maybe a blank line to separate the parts of the same type?

[John, 2016/06/24 17:47:57]

I don't know why the empty line's missing here.

As for the helper in asm-types, it seems a lot of "effort" to define those
helpers there -- and tests -- given that they are only useful for standard
members (IMO).

+  dqdq2d->AsFunctionType()->AddArgument(dq);
+
+  auto* f = AsmType::Float();
+  auto* fq = AsmType::FloatQ();
+  auto* fq2f = AsmType::Function(zone_, f);
+  fq2f->AsFunctionType()->AddArgument(fq);
+
+  auto* s = AsmType::Signed();
+  auto* s2s = AsmType::Function(zone_, s);
+  s2s->AsFunctionType()->AddArgument(s);
+
+  auto* i = AsmType::Int();
+  auto* ii2s = AsmType::Function(zone_, s);
+  ii2s->AsFunctionType()->AddArgument(i);
+  ii2s->AsFunctionType()->AddArgument(i);
+
+  auto* minmax_d = AsmType::MinMaxType(zone_, d, d);
+  auto* minmax_i = AsmType::MinMaxType(zone_, s, i);
+  auto* minmax = AsmType::OverloadedFunction(zone_);
+  minmax->AsOverloadedFunctionType()->AddOverload(minmax_i);
+  minmax->AsOverloadedFunctionType()->AddOverload(minmax_d);
+
+  auto* fround = AsmType::FroundType(zone_);
+
+  auto* abs = AsmType::OverloadedFunction(zone_);
+  abs->AsOverloadedFunctionType()->AddOverload(s2s);
+  abs->AsOverloadedFunctionType()->AddOverload(dq2d);
+  abs->AsOverloadedFunctionType()->AddOverload(fq2f);
+
+  auto* ceil = AsmType::OverloadedFunction(zone_);
+  ceil->AsOverloadedFunctionType()->AddOverload(dq2d);
+  ceil->AsOverloadedFunctionType()->AddOverload(fq2f);
+
+  auto* floor = ceil;
+  auto* sqrt = ceil;
+
+  struct StandardMemberInitializer {
+    const char* name;
+    StandardMember standard_member;
+    AsmType* type;
+  };
+
+  const StandardMemberInitializer math[] = {
+      {"PI", kMathPI, d},
+      {"E", kMathE, d},
+      {"LN2", kMathLN2, d},
+      {"LN10", kMathLN10, d},
+      {"LOG2E", kMathLOG2E, d},
+      {"LOG10E", kMathLOG10E, d},
+      {"SQRT2", kMathSQRT2, d},
+      {"SQRT1_2", kMathSQRT1_2, d},
+      {"imul", kMathImul, ii2s},
+      {"abs", kMathAbs, abs},
+      {"ceil", kMathCeil, ceil},
+      {"floor", kMathFloor, floor},
+      {"fround", kMathFround, fround},
+      {"pow", kMathPow, dqdq2d},
+      {"exp", kMathExp, dq2d},
+      {"log", kMathLog, dq2d},
+      {"min", kMathMin, minmax},
+      {"max", kMathMax, minmax},
+      {"sqrt", kMathSqrt, sqrt},
+      {"cos", kMathCos, dq2d},
+      {"sin", kMathSin, dq2d},
+      {"tan", kMathTan, dq2d},
+      {"acos", kMathAcos, dq2d},
+      {"asin", kMathAsin, dq2d},
+      {"atan", kMathAtan, dq2d},
+      {"atan2", kMathAtan2, dqdq2d},
+  };
+
+  const StandardMemberInitializer stdlib[] = {{"Infinity", kInfinity, d},
+                                              {"NaN", kNaN, d},
+#define ASM_TYPED_ARRAYS(V) \
+  V(Uint8)                  \
+  V(Int8)                   \
+  V(Uint16)                 \
+  V(Int16)                  \
+  V(Uint32)                 \
+  V(Int32)                  \
+  V(Float32)                \
+  V(Float64)
+
+#define ASM_TYPED_ARRAY(TypeName) \
+  {#TypeName "Array", kNone, AsmType::TypeName##Array()},
+                                              ASM_TYPED_ARRAYS(ASM_TYPED_ARRAY)
+#undef ASM_TYPED_ARRAY
+  };
+
+  for (unsigned ii = 0; ii < arraysize(stdlib); ++ii) {

[bradnelson, 2016/06/24 00:19:01]

https://google.github.io/styleguide/cppguide.html#Integer_Types

[John, 2016/06/24 17:47:56]

In all honesty, I copied this for from typing-asm.cc. :)

Done.

+    stdlib_types_[stdlib[ii].name] = new (zone_) VariableInfo(stdlib[ii].type);
+    stdlib_types_[stdlib[ii].name]->set_standard_member(
+        stdlib[ii].standard_member);
+    stdlib_types_[stdlib[ii].name]->set_mutability(
+        VariableInfo::kImmutableGlobal);
+  }
+
+  for (unsigned ii = 0; ii < arraysize(math); ++ii) {

[bradnelson, 2016/06/24 00:19:02]

put this closer to the list above?

[John, 2016/06/24 17:47:57]

Done.

+    stdlib_math_types_[math[ii].name] = new (zone_) VariableInfo(math[ii].type);
+    stdlib_math_types_[math[ii].name]->set_standard_member(
+        math[ii].standard_member);
+    stdlib_math_types_[math[ii].name]->set_mutability(
+        VariableInfo::kImmutableGlobal);
+  }
+}
+
+// Used for 5.5 GlobalVariableTypeAnnotations
+AsmTyper::VariableInfo* AsmTyper::ImportLookup(Property* import) {
+  auto* obj = import->obj();
+  auto* key = import->key()->AsLiteral();
+
+  ObjectTypeMap* stdlib = &stdlib_types_;
+  if (auto* obj_as_property = obj->AsProperty()) {
+    // This can only be stdlib.Math
+    auto* math_name = obj_as_property->key()->AsLiteral();
+    if (math_name == nullptr || !math_name->IsPropertyName()) {
+      return nullptr;
+    }
+
+    if (!math_name->AsPropertyName()->IsUtf8EqualTo(CStrVector("Math"))) {
+      return nullptr;
+    }
+
+    auto* stdlib_var_proxy = obj_as_property->obj()->AsVariableProxy();
+    if (stdlib_var_proxy == nullptr) {
+      return nullptr;
+    }
+    obj = stdlib_var_proxy;
+    stdlib = &stdlib_math_types_;
+  }
+
+  auto* obj_as_var_proxy = obj->AsVariableProxy();
+  if (obj_as_var_proxy == nullptr) {
+    return nullptr;
+  }
+
+  auto* obj_info = Lookup(obj_as_var_proxy->var());
+  if (obj_info == nullptr) {
+    return nullptr;
+  }
+
+  if (obj_info->IsFFI()) {
+    // For FFI we can't validate import->key, so assume this is OK.
+    return obj_info;
+  }
+
+  base::SmartArrayPointer<char> aname = key->AsPropertyName()->ToCString();
+  ObjectTypeMap::iterator i = stdlib->find(std::string(aname.get()));
+  if (i == stdlib->end()) {
+    return nullptr;
+  }
+  return i->second;
+}
+
+AsmTyper::VariableInfo* AsmTyper::Lookup(Variable* variable) {
+  ZoneHashMap* scope = in_function_ ? &local_scope_ : &global_scope_;
+  ZoneHashMap::Entry* entry =
+      scope->Lookup(variable, ComputePointerHash(variable));
+  if (!entry && in_function_) {

[bradnelson, 2016/06/24 00:19:01]

entry == nullptr

[John, 2016/06/24 17:47:57]

This was copied from typing-asm.cc, too. :)

Done.

+    entry = global_scope_.Lookup(variable, ComputePointerHash(variable));
+  }
+
+  if (entry == nullptr && module_name_->Equals(*variable->name())) {
+    return &module_info_;
+  }
+
+  return entry ? reinterpret_cast<VariableInfo*>(entry->value) : nullptr;
+}
+
+void AsmTyper::AddForwardReference(VariableProxy* proxy, VariableInfo* info) {
+  info->FirstForwardUseIs(proxy);
+  forward_definitions_.push_back(info);
+}
+
+bool AsmTyper::AddGlobal(Variable* variable, VariableInfo* info) {
+  // We can't DCHECK(!in_function_) because function may actually install global
+  // names (forward defined functions and function tables.)
+  DCHECK(info->mutability() != VariableInfo::kInvalidMutability);
+  DCHECK(info->IsGlobal());
+  DCHECK(ValidAsmIdentifier(variable->name()));
+
+  if (!module_name_.is_null() && module_name_->Equals(*variable->name())) {
+    return false;
+  }
+
+  ZoneHashMap::Entry* entry = global_scope_.LookupOrInsert(
+      variable, ComputePointerHash(variable), ZoneAllocationPolicy(zone_));
+
+  if (entry->value != nullptr) {
+    return false;
+  }
+
+  entry->value = info;
+  return true;
+}
+
+bool AsmTyper::AddLocal(Variable* variable, VariableInfo* info) {
+  DCHECK(in_function_);
+  DCHECK(info->mutability() != VariableInfo::kInvalidMutability);
+  DCHECK(!info->IsGlobal());
+  DCHECK(ValidAsmIdentifier(variable->name()));
+
+  ZoneHashMap::Entry* entry = global_scope_.LookupOrInsert(
+      variable, ComputePointerHash(variable), ZoneAllocationPolicy(zone_));
+
+  if (entry->value != nullptr) {
+    return false;
+  }
+
+  entry->value = info;
+  return true;
+}
+
+bool AsmTyper::Validate() {
+  if (!AsmType::None()->IsExactly(ValidateModule(root_))) {

[bradnelson, 2016/06/24 00:19:02]

Maybe note in the header that None() is used as a failure sentinel?

[John, 2016/06/24 17:47:58]

Done.

+    return true;
+  }
+  return false;
+}
+
+namespace {
+bool HasUseAsmDirective(FunctionLiteral* fun) {
+  if (fun->body() == nullptr) {

[bradnelson, 2016/06/24 00:19:02]

Why not get this out of the flattened traversal?
(we don't need this to be fast as the ast comes with asm_module pre-marked)

[John, 2016/06/24 17:47:56]

I copied this over from the previous validator. done.

+    return false;
+  }
+  ZoneList<Statement*>* body = fun->body();
+  if (body == nullptr || body->is_empty()) {
+    return false;
+  }
+  ExpressionStatement* use_asm = body->first()->AsExpressionStatement();
+  if (use_asm == nullptr) return false;
+  Literal* use_asm_literal = use_asm->expression()->AsLiteral();
+  if (use_asm_literal == nullptr) return false;
+  if (!use_asm_literal->raw_value()->AsString()->IsOneByteEqualTo("use asm"))
+    return false;
+  return true;
+}
+
+Assignment* ExtractInitializerExpression(Statement* statement) {
+  auto* expr_stmt = statement->AsExpressionStatement();
+  if (expr_stmt == nullptr) {
+    // Done with initializers.
+    return nullptr;
+  }
+  auto* assign = expr_stmt->expression()->AsAssignment();
+  if (assign == nullptr) {
+    // Done with initializers.
+    return nullptr;
+  }
+  if (assign->op() != Token::INIT) {
+    // Done with initializers.
+    return nullptr;
+  }
+  return assign;
+}
+
+}  // namespace
+
+// 6.1 ValidateModule
+AsmType* AsmTyper::ValidateModule(FunctionLiteral* fun) {
+  Scope* scope = fun->scope();
+  if (!scope->is_function_scope()) FAIL(fun, "not at function scope.");
+  if (!HasUseAsmDirective(fun)) FAIL(fun, "missing \"use asm\".");
+  if (!ValidAsmIdentifier(fun->name()))
+    FAIL(fun, "Invalid ASM.js identifier in module name.");
+  module_name_ = fun->name();
+
+  // Allowed parameters: Stdlib, FFI, Mem
+  static constexpr uint32_t MaxModuleParameters = 3;
+  if (scope->num_parameters() > MaxModuleParameters) {
+    FAIL(fun, "ASM.js modules may not have more than three parameters.");
+  }
+
+  struct {
+    StandardMember standard_member;
+    AsmType* type;
+  } kModuleParamInfo[3] = {
+      {kStdlib, AsmType::None()},
+      {kFFI, AsmType::FFIType(zone_)},
+      {kHeap, AsmType::None()},
+  };
+
+  for (int ii = 0; ii < scope->num_parameters(); ++ii) {
+    Variable* param = scope->parameter(ii);
+    DCHECK(param);
+
+    if (!ValidAsmIdentifier(param->name())) {
+      FAIL(fun, "Invalid ASM.js identifier in module parameter.");

[bradnelson, 2016/06/24 00:19:00]

I had been using Asm.js everywhere, but actually the site + wikipedia seem to
have decided on asm.js

[John, 2016/06/24 17:47:56]

Done.

+    }
+
+    auto* param_info = new (zone_) VariableInfo();
+    param_info->set_mutability(VariableInfo::kImmutableGlobal);
+    param_info->set_standard_member(kModuleParamInfo[ii].standard_member);
+    param_info->set_type(kModuleParamInfo[ii].type);
+
+    if (!AddGlobal(param, param_info)) {
+      FAIL(fun, "Redeclared identifier in module parameter.");
+    }
+  }
+
+  ZoneVector<Assignment*> function_pointer_tables(zone_);
+  FlattenedStatements iter(zone_, fun->body());
+  iter.Next();  // skips the "use asm" directive.

[bradnelson, 2016/06/24 00:19:01]

why not just check for use asm here?

[John, 2016/06/24 17:47:56]

Done.

+  ReturnStatement* module_return = nullptr;
+
+  // *VIOLATION* The spec states that globals should be followed by function
+  // declarations, which should be followed by function pointer tables, followed
+  // by the module export (return) statement. Our AST might be rearraged by the
+  // parser, so we can't rely on it being in source code order.
+  while (Statement* current = iter.Next()) {
+    if (auto* assign = ExtractInitializerExpression(current)) {
+      if (assign->value()->IsArrayLiteral()) {
+        // Save function tables for later validation.
+        function_pointer_tables.push_back(assign);
+      } else {
+        RECURSE(ValidateGlobalDeclaration(assign));
+      }
+      continue;
+    }
+
+    if (auto* current_as_return = current->AsReturnStatement()) {
+      if (module_return != nullptr) {
+        FAIL(fun, "Multiple export statements.");
+      }
+      module_return = current_as_return;
+      continue;
+    }
+
+    FAIL(current, "Invalid top-level statement in ASM.js module.");
+  }
+
+  ZoneList<Declaration*>* decls = scope->declarations();
+
+  for (int ii = 0; ii < decls->length(); ++ii) {
+    Declaration* decl = decls->at(ii);
+
+    if (FunctionDeclaration* fun_decl = decl->AsFunctionDeclaration()) {
+      RECURSE(ValidateFunction(fun_decl));
+      continue;
+    }
+  }
+
+  for (auto* function_table : function_pointer_tables) {
+    RECURSE(ValidateFunctionTable(function_table));
+  }
+
+  for (int ii = 0; ii < decls->length(); ++ii) {
+    Declaration* decl = decls->at(ii);
+
+    if (decl->IsFunctionDeclaration()) {
+      continue;
+    }
+
+    VariableDeclaration* var_decl = decl->AsVariableDeclaration();
+    if (var_decl == nullptr) {
+      FAIL(decl, "Invalid ASM.js declaration.");

[bradnelson, 2016/06/24 00:19:01]

asm.js

[John, 2016/06/24 17:47:56]

Done.

+    }
+
+    auto* var_proxy = var_decl->proxy();
+    if (var_proxy == nullptr) {
+      FAIL(decl, "Invalid ASM.js declaration.");

[bradnelson, 2016/06/24 00:19:01]

asm.js

[John, 2016/06/24 17:47:57]

Done.

+    }
+
+    if (Lookup(var_proxy->var()) == nullptr) {
+      FAIL(decl, "Global variable missing initializer in ASM.js module.");
+    }
+  }
+
+  // 6.2 ValidateExport
+  if (module_return == nullptr) {
+    FAIL(fun, "Missing ASM.js module export.");
+  }
+
+  for (auto* forward_def : forward_definitions_) {
+    if (forward_def->missing_definition()) {
+      FAIL(forward_def->first_forward_use(),
+           "Missing definition for forward declared identifier.");
+    }
+  }
+
+  RECURSE(ValidateExport(module_return));
+
+  return AsmType::Int();  // Any type that is not AsmType::None();

[bradnelson, 2016/06/24 00:19:01]

Actually, any reason to make this return a type? Why not a boolean?

[John, 2016/06/24 17:47:56]

Consistency is not usually a good reason, but it is here: all ValidateXXX
methods return an AsmType* so that the RECURSE macro works for everything. I
could do something like:

bool IsFailure(AsmType* type) {
 return type == AsmType::None();
}

bool IsFailure(bool b) { return b; }

#define RECURSE(call) do {  \
  auto value = (call);      \
  if (IsFailure(call)) {    \
    return AsmType::None(); \
  }                         \
} while (0)

But that would not work because (1) some functions return bool, and if the
compiler converts AsmType::None() to bool, we will get !false (because
AsmType::None() != nullptr). That problem is also easily fixed: we just need a
failure type that can be automatically converted to the right failure value:

struct failure {
  failure();
  /*implicit*/ operator AsmType* () const { return AsmType::None(); }
  /*implicit*/ operator bool () const { return false; }
};

so we could have

#define RECURSE(call) do { \
  if (IsFailure(call)) {   \
    return failure();      \
  }                        \
} while (0)

But, to be honest, I don't like this kind of cleverness in non-test harness
code. Up to you, though/

[bradn, 2016/06/24 18:57:03]

Meh. Kind of like it as is too.
What if we changed None to Error / Failure or something?
That might make it more clear without much change.
I found myself occassionally confusing None and Void.

[John, 2016/07/07 16:46:56]

Failure() makes sense in the context of validation, but it does not make sense
(to me) to have failure type. In a way, None() represents nullptr -- which I try
not to use for AsmType* variables. Will think a bit more about this.

+}
+
+// 6.? ValidateGlobalDeclaration
+namespace {
+bool MayBeDoubleAnnotation(BinaryOperation* binop) {

[bradnelson, 2016/06/24 00:19:02]

While agreed that the current representation in the AST leaves abiguity around
+x vs x * 1.0, it reads a little confusingly to have that expressed in the name
of the function (i.e. it makes it look like something more complex it going on).

[John, 2016/06/24 17:47:57]

Done.

+  // *VIOLATION* The parser replaces uses of +x with x*1.0.
+  if (binop->op() != Token::MUL) {
+    return false;
+  }
+
+  auto* right_as_literal = binop->right()->AsLiteral();
+  if (right_as_literal == nullptr) {
+    return false;
+  }
+
+  return right_as_literal->raw_value()->ContainsDot() &&
+         right_as_literal->raw_value()->AsNumber() == 1.0;
+}
+
+bool IsIntAnnotation(BinaryOperation* binop) {
+  if (binop->op() != Token::BIT_OR) {
+    return false;
+  }
+
+  auto* right_as_literal = binop->right()->AsLiteral();
+  if (right_as_literal == nullptr) {
+    return false;
+  }
+
+  return !right_as_literal->raw_value()->ContainsDot() &&
+         right_as_literal->raw_value()->AsNumber() == 0.0;
+}
+}  // namespace
+
+AsmType* AsmTyper::ValidateGlobalDeclaration(Assignment* assign) {
+  DCHECK(!assign->is_compound());
+  if (assign->is_compound()) {
+    FAIL(assign,
+         "Compound assignment not supported when declaring global variables.");
+  }
+
+  auto* target = assign->target();
+  if (!target->IsVariableProxy()) {
+    FAIL(target, "Module assignments may only assign to globals.");
+  }
+  auto* target_variable = target->AsVariableProxy()->var();
+  auto* target_info = Lookup(target_variable);
+
+  if (target_info != nullptr) {
+    FAIL(target, "Redefined global variable.");
+  }
+
+  auto* value = assign->value();
+  // Not all types of assignment are allowed by asm.js. See
+  // 5.5 Global Variable Type Annotations.
+  if (value->IsLiteral() || value->IsCall()) {
+    AsmType* type = nullptr;
+    RECURSE(type = VariableTypeAnnotations(value));
+    target_info = new (zone_) VariableInfo(type);
+    target_info->set_mutability(VariableInfo::kMutableGlobal);
+  } else if (value->IsProperty()) {
+    target_info = ImportLookup(value->AsProperty());
+    if (target_info == nullptr) {
+      FAIL(assign, "Invalid import.");
+    }
+    CHECK(target_info->mutability() == VariableInfo::kImmutableGlobal);
+    if (!target_info->IsFFI()) {
+      target_info = target_info->Clone(zone_);
+    } else {
+      // create a new target info that represents a foreign function.
+      DCHECK(target_info->type()->AsFFIType() != nullptr);
+      target_info = new (zone_) VariableInfo(target_info->type());
+      target_info->set_mutability(VariableInfo::kImmutableGlobal);
+    }
+  } else if (value->IsBinaryOperation()) {
+    // This should either be:
+    //
+    // var <> = ffi.<>|0
+    //
+    // or
+    //
+    // var <> = +ffi.<>
+    auto* value_binop = value->AsBinaryOperation();
+    auto* left = value_binop->left();
+    AsmType* import_type = nullptr;
+
+    if (MayBeDoubleAnnotation(value_binop)) {
+      // *VIOLATION* if the asm source was
+      //

[bradnelson, 2016/06/24 00:19:00]

This seems off?

[John, 2016/06/24 17:47:58]

I don't know what I had in mind. Done.

+      // var foreign_func = +foreign.func
+      //
+      // we will validate, even though we shouldn't.
+      import_type = AsmType::Double();
+    } else if (IsIntAnnotation(value_binop)) {
+      import_type = AsmType::Int();
+    } else {
+      FAIL(value,
+           "Invalid initializer for foreign import - unrecognized annotation.");
+    }
+
+    if (!left->IsProperty()) {
+      FAIL(value,
+           "Invalid initializer for foreign import - must import member.");
+    }
+    target_info = ImportLookup(left->AsProperty());
+    if (target_info == nullptr) {
+      // TODO(jpp): this error message is innacurate: this may fail if the
+      // object lookup fails, or if the property lookup fails, or even if the
+      // import is bogus like a().c.
+      FAIL(value,
+           "Invalid initializer for foreign import - object lookup failed.");
+    }
+    CHECK(target_info->mutability() == VariableInfo::kImmutableGlobal);
+    if (!target_info->IsFFI()) {
+      FAIL(value,
+           "Invalid initializer for foreign import - object is not the ffi.");
+    }
+
+    // Create a new target info that represents the foreign import.

[bradnelson, 2016/06/24 00:19:02]

variable

[John, 2016/06/24 17:47:56]

Done.

+    DCHECK(target_info->type()->AsFFIType() != nullptr);
+    target_info = new (zone_) VariableInfo(import_type);
+    target_info->set_mutability(VariableInfo::kMutableGlobal);
+  } else if (value->IsCallNew()) {
+    AsmType* type = nullptr;
+    RECURSE(type = NewHeapView(value->AsCallNew()));
+    target_info = new (zone_) VariableInfo(type);
+    target_info->set_mutability(VariableInfo::kImmutableGlobal);
+  }
+
+  if (target_info == nullptr) {
+    FAIL(assign, "Invalid global variable initializer.");
+  }
+
+  if (!ValidAsmIdentifier(target_variable->name())) {
+    FAIL(target, "Invalid ASM.js identifier in global variable.");
+  }
+
+  if (!AddGlobal(target_variable, target_info)) {
+    FAIL(assign, "Redeclared global identifier");
+  }
+
+  DCHECK(target_info->type() != AsmType::None());
+  return target_info->type();
+}
+
+// 6.3 ValidateFunctionTable
+AsmType* AsmTyper::ValidateFunctionTable(Assignment* assign) {
+  if (assign->is_compound()) {
+    FAIL(assign,
+         "Compound assignment not supported when declaring global variables.");
+  }
+
+  auto* target = assign->target();
+  if (!target->IsVariableProxy()) {
+    FAIL(target, "Module assignments may only assign to globals.");
+  }
+  auto* target_variable = target->AsVariableProxy()->var();
+
+  auto* value = assign->value()->AsArrayLiteral();
+  CHECK(value != nullptr);
+  ZoneList<Expression*>* pointers = value->values();
+
+  // The function table size must be n = 2 ** m, for m >= 0;

[bradnelson, 2016/06/24 00:19:02]

Not in the spec, but think we should cap this? Nah.

[John, 2016/06/24 17:47:57]

Maybe. I added a TODO here

+  if (!base::bits::IsPowerOfTwo32(pointers->length())) {
+    FAIL(assign, "Invalid length for function pointer table.");
+  }
+
+  AsmType* table_element_type = nullptr;
+  AsmCallableType* callable_type = nullptr;
+  for (auto* initializer : *pointers) {
+    auto* var_proxy = initializer->AsVariableProxy();
+    if (var_proxy == nullptr) {
+      FAIL(initializer,
+           "Function pointer table initializer must be a function name.");
+    }
+
+    auto* var_info = Lookup(var_proxy->var());
+    if (var_info == nullptr) {
+      FAIL(var_proxy,
+           "Undefined identifier in function pointer table initializer.");
+    }
+
+    if (var_info->standard_member() != kNone) {
+      FAIL(initializer,
+           "Function pointer table must not be a member of the standard "
+           "library.");
+    }
+
+    auto* initializer_callable = var_info->type()->AsFunctionType();

[bradnelson, 2016/06/24 00:19:01]

Don't we need to ban FFI ones?

[John, 2016/06/24 17:47:57]

From function tables? Yes, but the FFI type is not an AsmFunctionType, it is an
AsmCallableType. I left a DCHECK behind, just in case.

[bradn, 2016/06/24 18:57:03]

A confused the inheritance relationship. Makes sense.

+    if (initializer_callable == nullptr) {
+      FAIL(initializer,
+           "Function pointer table initializer must be an ASM.js function.");
+    }
+
+    if (callable_type == nullptr) {
+      table_element_type = var_info->type();
+      callable_type = initializer_callable;
+    } else if (callable_type->ValidateCall(initializer_callable->ReturnType(),
+                                           initializer_callable->Arguments()) ==
+               AsmType::None()) {
+      FAIL(initializer, "Type mismatch in function pointer table initializer.");
+    }
+  }
+
+  auto* target_info = Lookup(target_variable);
+  if (target_info == nullptr) {
+    // Function pointer tables are the last entities to be validates, so this is
+    // unlikely to happen: only unreferenced function tables will not already
+    // have an entry in the global scope.
+    target_info = new (zone_) VariableInfo(AsmType::FunctionTableType(
+        zone_, pointers->length(), table_element_type));
+    target_info->set_mutability(VariableInfo::kImmutableGlobal);
+    if (!ValidAsmIdentifier(target_variable->name())) {
+      FAIL(target, "Invalid ASM.js identifier in function table name.");
+    }
+    if (!AddGlobal(target_variable, target_info)) {
+      DCHECK(false);
+      FAIL(assign, "Redeclared global identifier in function table name.");
+    }
+    return target_info->type();
+  }
+
+  if (!target_info->missing_definition()) {
+    FAIL(assign, "Redefined identifier in function table name.");
+  }
+
+  target_info->MarkDefined();
+
+  auto* target_info_table = target_info->type()->AsFunctionTableType();
+  if (target_info_table == nullptr) {
+    FAIL(assign, "Identifier redefined as function pointer table.");
+  }
+
+  if (target_info_table->length() != pointers->length()) {
+    FAIL(assign, "Function table size mismatch.");
+  }
+
+  auto* function_type = callable_type->AsFunctionType();
+  if (target_info_table->ValidateCall(function_type->ReturnType(),
+                                      function_type->Arguments()) ==
+      AsmType::None()) {
+    FAIL(assign, "Function table initializer does not match previous type.");
+  }
+
+  return target_info->type();

[bradnelson, 2016/06/24 00:19:02]

DCHECK non-None?

[John, 2016/06/24 17:47:57]

We know that by construction: if target_info->type() == None(), then the cast in
763 would've failed. I added a check, just in case.

+}
+
+// 6.2 ValidateExport
+AsmType* AsmTyper::ValidateExport(ReturnStatement* exports) {
+  // ASM.js modules can export single functions, or multiple functions in an
+  // object literal.
+  if (auto* fun_export = exports->expression()->AsVariableProxy()) {
+    // Exporting single function.
+    auto* fun_info = Lookup(fun_export->var());
+    if (fun_info == nullptr) {
+      FAIL(fun_export, "Undefined identifier in ASM.js module export.");
+    }
+
+    if (fun_info->type()->AsFunctionType() == nullptr) {
+      FAIL(fun_export, "ASM.js module export is not an ASM.js function.");
+    }
+
+    if (fun_info->standard_member() != kNone) {
+      FAIL(fun_export, "ASM.js module export must be an ASM.js function.");
+    }
+
+    return fun_info->type();
+  }
+
+  if (auto* obj_export = exports->expression()->AsObjectLiteral()) {
+    // Exporting object literal.
+    for (auto* prop : *obj_export->properties()) {
+      if (!prop->key()->IsLiteral()) {
+        FAIL(prop->key(),
+             "Only normal object properties may be used in the export object "
+             "literal.");
+      }
+      auto* export_obj = prop->value()->AsVariableProxy();
+      if (export_obj == nullptr) {
+        FAIL(prop->value(), "Exported value must be an ASM.js function name.");
+      }
+
+      auto* fun_info = Lookup(export_obj->var());
+      if (fun_info == nullptr) {
+        FAIL(export_obj,
+             "Undefined identifier in ASM.js module export property.");
+      }
+
+      if (fun_info->standard_member() != kNone) {
+        FAIL(export_obj,
+             "ASM.js module export cannot contain standard library functions.");

[bradnelson, 2016/06/24 00:19:03]

Forbid foreign imports

[John, 2016/06/24 17:47:58]

Are you asking me to change the error message, or to handle FFIs? FFIs are
handled by the following if. left a DCHECK behind.

+      }
+
+      if (fun_info->type()->AsFunctionType() == nullptr) {
+        FAIL(export_obj,
+             "ASM.js module export property is not an ASM.js function.");
+      }
+    }
+    return AsmType::Int();
+  }
+
+  FAIL(exports, "Unrecognized expression in ASM.js module export expression.");
+}
+
+// 6.4 ValidateFunction
+AsmType* AsmTyper::ValidateFunction(FunctionDeclaration* fun_decl) {
+  FunctionScope _(this);
+
+  // Extract parameter types.
+  auto* fun = fun_decl->fun();
+
+  auto* fun_decl_proxy = fun_decl->proxy();
+  if (fun_decl_proxy == nullptr) {
+    FAIL(fun_decl, "Anonymous functions are not support in ASM.js.");
+  }
+
+  Statement* current;
+  FlattenedStatements iter(zone_, fun->body());
+
+  size_t annotated_parameters = 0;
+
+  // 5.3 Function type annotations
+  //     * parameters
+  ZoneVector<AsmType*> parameter_types(zone_);
+  for (; (current = iter.Next()) != nullptr; ++annotated_parameters) {
+    auto* stmt = current->AsExpressionStatement();
+    if (stmt == nullptr) {
+      // Done with parameters.
+      break;
+    }
+    auto* expr = stmt->expression()->AsAssignment();
+    if (expr == nullptr || expr->is_compound()) {
+      // Done with parameters.
+      break;
+    }
+    auto* proxy = expr->target()->AsVariableProxy();
+    if (proxy == nullptr) {
+      // Done with parameters.
+      break;
+    }
+    auto* param = proxy->var();
+    if (param->location() != VariableLocation::PARAMETER ||
+        param->index() != annotated_parameters) {
+      // Done with parameters.
+      break;
+    }
+
+    AsmType* type;
+    RECURSE(type = ParameterTypeAnnotations(param, expr->value()));
+    DCHECK(type->IsParameterType());
+    auto* param_info = new (zone_) VariableInfo(type);
+    param_info->set_mutability(VariableInfo::kLocal);
+    if (!ValidAsmIdentifier(proxy->name())) {
+      FAIL(proxy, "Invalid ASM.js identifier in parameter name.");
+    }
+
+    if (!AddLocal(param, param_info)) {
+      FAIL(proxy, "Redeclared local.");
+    }
+    parameter_types.push_back(type);
+  }
+
+  if (annotated_parameters != fun->parameter_count()) {
+    FAIL(fun_decl, "Incorrect parameter type annotations.");
+  }
+
+  // 5.3 Function type annotations
+  //     * locals
+  for (; current; current = iter.Next()) {
+    auto* initializer = ExtractInitializerExpression(current);
+    if (initializer == nullptr) {
+      // Done with locals.
+      break;
+    }
+
+    auto* local = initializer->target()->AsVariableProxy();
+    if (local == nullptr) {
+      // Done with locals... or maybe an error?

[bradnelson, 2016/06/24 00:19:03]

I get your meaning, but maybe clarify you mean that we might be here because of
an assignment that isn't a declaration.

[John, 2016/06/24 17:47:58]

Done.

+      break;
+    }
+
+    AsmType* type;
+    RECURSE(type = VariableTypeAnnotations(initializer->value()));
+    auto* local_info = new (zone_) VariableInfo(type);
+    local_info->set_mutability(VariableInfo::kLocal);
+    if (!ValidAsmIdentifier(local->name())) {
+      FAIL(local, "Invalid ASM.js identifier in local variable.");
+    }
+
+    if (!AddLocal(local->var(), local_info)) {
+      FAIL(initializer, "Redeclared local.");
+    }
+  }
+
+  // 5.2 Return Type Annotations
+  // *VIOLATION* we peel blocks to find the last statement in the ASM module
+  // because the parser may introduce synthetic blocks.
+  if (fun->body()->length() == 0) {
+    return_type_ = AsmType::Void();
+  } else {
+    auto* last_statement = fun->body()->last();

[bradnelson, 2016/06/24 00:19:01]

Since we walk this all anyway, maybe no need to do this here (ie do at the end)?
Could be a TODO if you like.

[John, 2016/06/24 17:47:56]

That's what I thought, but then validating:

function foo() {
  if (1) return 1.0;
}

becomes a bit uglier. I decided this was probably better to do this here. Do you
want me to change it?

[bradn, 2016/06/24 18:57:03]

This is ok. Maybe put a TODO / NOTE that this won't cope with things like if the
block structure around returns changes in the ast.
(I suppose you could add a reverse iterator over the statements, but that seems
overkill too).

+    while (auto* as_block = last_statement->AsBlock()) {
+      last_statement = as_block->statements()->last();
+    }
+    // We don't check whether AsReturnStatement() below returns non-null -- we
+    // leave that to the ReturnTypeAnnotations method.
+    return_type_ = ReturnTypeAnnotations(last_statement->AsReturnStatement());
+  }
+  DCHECK(return_type_);
+  DCHECK(return_type_->IsReturnType());
+
+  for (auto* decl : *fun->scope()->declarations()) {

[bradnelson, 2016/06/24 00:19:03]

Maybe comment this revisits the ones above?

[John, 2016/06/24 17:47:56]

Does it? This visits the declarations for the current function, which only
happens once?...

[bradn, 2016/06/24 18:57:02]

Oops, misread. You're right.

+    auto* var_decl = decl->AsVariableDeclaration();
+    if (var_decl == nullptr) {
+      FAIL(decl, "Functions may only define inner variables.");
+    }
+
+    auto* var_proxy = var_decl->proxy();
+    if (var_proxy == nullptr) {
+      FAIL(decl, "Invalid local declaration declaration.");
+    }
+
+    auto* var_info = Lookup(var_proxy->var());
+    if (var_info == nullptr || var_info->IsGlobal()) {
+      FAIL(decl, "Local variable missing initializer in ASM.js module.");
+    }
+  }
+
+  for (; current; current = iter.Next()) {
+    AsmType* current_type;
+    RECURSE(current_type = ValidateStatement(current));
+  }
+
+  auto* fun_type = AsmType::Function(zone_, return_type_);
+  auto* fun_type_as_function = fun_type->AsFunctionType();
+  for (auto* param_type : parameter_types) {
+    fun_type_as_function->AddArgument(param_type);
+  }
+
+  auto* fun_var = fun_decl_proxy->var();
+  auto* fun_info = new (zone_) VariableInfo(fun_type);
+  fun_info->set_mutability(VariableInfo::kImmutableGlobal);
+  auto* old_fun_type = Lookup(fun_var);
+  if (old_fun_type == nullptr) {
+    if (!ValidAsmIdentifier(fun_var->name())) {
+      FAIL(fun_decl_proxy, "Invalid ASM.js identifier in function name.");
+    }
+    if (!AddGlobal(fun_var, fun_info)) {
+      DCHECK(false);
+      FAIL(fun_decl, "Redeclared global identifier.");
+    }
+    return fun_type;
+  }
+
+  // Not necessarily an error -- fun_decl might have been used before being
+  // defined. If that's the case, then the type in the global environment must
+  // be the same as the type inferred by the parameter/return type annotations.
+  old_fun_type->MarkDefined();
+  auto* old_fun_callable = old_fun_type->type()->AsCallableType();
+  if (old_fun_callable == nullptr) {
+    FAIL(fun_decl, "Redefinition of global name with different type.");
+  }
+  if (old_fun_callable->ValidateCall(fun_type_as_function->ReturnType(),
+                                     fun_type_as_function->Arguments()) ==
+      AsmType::None()) {
+    FAIL(fun_decl, "Signature mismatch when declaring function.");
+  }
+
+  return fun_type;
+}
+
+// 6.5 ValidateStatement
+AsmType* AsmTyper::ValidateStatement(Statement* statement) {
+  switch (statement->node_type()) {
+    default:
+      FAIL(statement, "Invalid ASM.js statement.");

[bradnelson, 2016/06/24 00:19:00]

Statement type invalid for asm.js ?

[John, 2016/06/24 17:47:57]

Done.

+    case AstNode::kBlock:

[bradnelson, 2016/06/24 00:19:02]

Shouldn't the Flattener eat these?

[John, 2016/06/24 17:47:57]

that's what I thought, until I tried to validate this:

function asm() {
  "use asm";
  function f() {
    if (v()|0) { f(); return };
  }
  function v() { return 0; }
  return f;
}

and I got an "Invalid ASM.js statement." :)

The FlattenedStatements iterator will flatten the statements in a statement
list, but not the sub-statements of those statements.

+      return ValidateBlockStatement(statement->AsBlock());
+    case AstNode::kExpressionStatement:
+      return ValidateExpressionStatement(statement->AsExpressionStatement());
+    case AstNode::kEmptyStatement:
+      return ValidateEmptyStatement(statement->AsEmptyStatement());
+    case AstNode::kIfStatement:
+      return ValidateIfStatement(statement->AsIfStatement());
+    case AstNode::kReturnStatement:
+      return ValidateReturnStatement(statement->AsReturnStatement());
+    case AstNode::kWhileStatement:
+      return ValidateWhileStatement(statement->AsWhileStatement());
+    case AstNode::kDoWhileStatement:
+      return ValidateDoWhileStatement(statement->AsDoWhileStatement());
+    case AstNode::kForStatement:
+      return ValidateForStatement(statement->AsForStatement());
+    case AstNode::kBreakStatement:
+      return ValidateBreakStatement(statement->AsBreakStatement());
+    case AstNode::kContinueStatement:
+      return ValidateContinueStatement(statement->AsContinueStatement());
+    case AstNode::kSwitchStatement:
+      return ValidateSwitchStatement(statement->AsSwitchStatement());
+  }
+
+  return AsmType::Void();
+}
+
+// 6.5.1 BlockStatement
+AsmType* AsmTyper::ValidateBlockStatement(Block* block) {
+  FlattenedStatements iter(zone_, block->statements());
+
+  while (auto* current = iter.Next()) {
+    RECURSE(ValidateStatement(current));
+  }
+
+  return AsmType::Void();
+}
+
+// 6.5.2 ExpressionStatement
+AsmType* AsmTyper::ValidateExpressionStatement(ExpressionStatement* expr) {
+  auto* expression = expr->expression();
+  if (auto* call = expression->AsCall()) {
+    RECURSE(ValidateCall(AsmType::Void(), call));
+  } else {
+    RECURSE(ValidateExpression(expression));
+  }
+
+  return AsmType::Void();
+}
+
+// 6.5.3 EmptyStatement
+AsmType* AsmTyper::ValidateEmptyStatement(EmptyStatement* empty) {
+  return AsmType::Void();
+}
+
+// 6.5.4 IfStatement
+AsmType* AsmTyper::ValidateIfStatement(IfStatement* if_stmt) {
+  AsmType* cond_type;
+  RECURSE(cond_type = ValidateExpression(if_stmt->condition()));
+  if (!cond_type->IsA(AsmType::Int())) {
+    FAIL(if_stmt->condition(), "If condition must be int.");

[bradnelson, 2016/06/24 00:19:02]

be type int?

[John, 2016/06/24 17:47:56]

Done.

+  }
+  RECURSE(ValidateStatement(if_stmt->then_statement()));
+  RECURSE(ValidateStatement(if_stmt->else_statement()));
+  return AsmType::Void();
+}
+
+// 6.5.5 ReturnStatement
+AsmType* AsmTyper::ValidateReturnStatement(ReturnStatement* ret_stmt) {
+  AsmType* ret_expr_type = AsmType::Void();
+  if (auto* ret_expr = ret_stmt->expression()) {
+    RECURSE(ret_expr_type = ValidateExpression(ret_expr));
+    if (ret_expr_type == AsmType::Void()) {
+      // *VIOLATION* The parser modifies the source code so that expressionless
+      // returns will return undefined, so we need to allow that.
+      if (!ret_expr->IsUndefinedLiteral()) {
+        FAIL(ret_stmt, "Return statement expression can't be void.");
+      }
+    }
+  }
+
+  if (!ret_expr_type->IsA(return_type_)) {
+    FAIL(ret_stmt, "Type mismatch in return statement.");
+  }
+
+  return ret_expr_type;
+}
+
+// 6.5.6 IterationStatement
+// 6.5.6.a WhileStatement
+AsmType* AsmTyper::ValidateWhileStatement(WhileStatement* while_stmt) {
+  AsmType* cond_type;
+  RECURSE(cond_type = ValidateExpression(while_stmt->cond()));
+  if (!cond_type->IsA(AsmType::Int())) {
+    FAIL(while_stmt->cond(), "While condition must be int.");
+  }
+
+  if (auto* body = while_stmt->body()) {
+    RECURSE(ValidateStatement(body));
+  }
+  return AsmType::Void();
+}
+
+// 6.5.6.b DoWhileStatement
+AsmType* AsmTyper::ValidateDoWhileStatement(DoWhileStatement* do_while) {
+  AsmType* cond_type;
+  RECURSE(cond_type = ValidateExpression(do_while->cond()));
+  if (!cond_type->IsA(AsmType::Int())) {
+    FAIL(do_while->cond(), "Do {} While condition must be int.");
+  }
+
+  if (auto* body = do_while->body()) {
+    RECURSE(ValidateStatement(body));
+  }
+  return AsmType::Void();
+}
+
+// 6.5.6.c ForStatement
+AsmType* AsmTyper::ValidateForStatement(ForStatement* for_stmt) {
+  if (auto* init = for_stmt->init()) {
+    RECURSE(ValidateStatement(init));
+  }
+
+  if (auto* cond = for_stmt->cond()) {
+    AsmType* cond_type;
+    RECURSE(cond_type = ValidateExpression(cond));
+    if (!cond_type->IsA(AsmType::Int())) {
+      FAIL(cond, "For condition must be int.");
+    }
+  }
+
+  if (auto* next = for_stmt->next()) {
+    RECURSE(ValidateStatement(next));
+  }
+
+  if (auto* body = for_stmt->body()) {
+    RECURSE(ValidateStatement(body));
+  }
+
+  return AsmType::Void();
+}
+
+// 6.5.7 BreakStatement
+AsmType* AsmTyper::ValidateBreakStatement(BreakStatement* brk_stmt) {

[bradnelson, 2016/06/24 00:19:02]

Starting to feel kind of odd that the statements return types.
I suppose it avoid a failure flag on the object, but I wonder if maybe it's more
confusing... Not sure. Leave it up to you.

[John, 2016/06/24 17:47:57]

I agree, but see above. There's a solution, but that solution seems like over
engineering. I don't care one way or the other.

[bradn, 2016/06/24 18:57:03]

See above.

+  return AsmType::Void();
+}
+
+// 6.5.8 ContinueStatement
+AsmType* AsmTyper::ValidateContinueStatement(ContinueStatement* cont_stmt) {
+  return AsmType::Void();
+}
+
+// 6.5.9 LabelledStatement
+// JPP here, not sure what to do.

[bradnelson, 2016/06/24 00:19:02]

These are kind of like BreakableStatements in our AST, but these inherit from
Statement, so you get the desired behavior anyhow.

[John, 2016/06/24 17:47:56]

Done.

+
+// 6.5.10 SwitchStatement
+namespace {
+bool ExtractInt32CaseLabel(CaseClause* clause, int32_t* lbl) {
+  auto* lbl_expr = clause->label()->AsLiteral();
+
+  if (lbl_expr == nullptr) {
+    return false;
+  }
+
+  if (lbl_expr->raw_value()->ContainsDot()) {
+    return false;
+  }
+
+  return lbl_expr->value()->ToInt32(lbl);
+}
+}  // namespace
+
+AsmType* AsmTyper::ValidateSwitchStatement(SwitchStatement* stmt) {
+  AsmType* cond_type;
+  RECURSE(cond_type = ValidateExpression(stmt->tag()));
+  if (!cond_type->IsA(AsmType::Signed())) {
+    FAIL(stmt, "Switch tag must be signed.");
+  }
+
+  bool has_default = false;
+
+  ZoneSet<int32_t> cases_seen(zone_);
+  for (auto* a_case : *stmt->cases()) {
+    if (a_case->is_default()) {
+      CHECK(!has_default);
+      RECURSE(ValidateDefault(a_case));
+      has_default = true;
+    }
+
+    // This checks some of 6.6 ValidateCase.
+    int32_t case_lbl;
+    if (!ExtractInt32CaseLabel(a_case, &case_lbl)) {

[bradnelson, 2016/06/24 00:19:00]

Would mirror the spec better if this was inside ValidateCase ?

[John, 2016/06/24 17:47:57]

I was trying to avoid adding an output parameter to ValidateCase, but done.

+      FAIL(a_case, "Case label must be a 32-bit signed integer.");
+    }
+
+    auto case_lbl_pos = cases_seen.find(case_lbl);
+    if (case_lbl_pos != cases_seen.end() && *case_lbl_pos == case_lbl) {
+      FAIL(a_case, "Duplicated case label.");
+    }
+    cases_seen.insert(case_lbl);
+
+    RECURSE(ValidateCase(a_case));
+  }
+
+  if (!cases_seen.empty()) {
+    const int64_t max_lbl = *cases_seen.rbegin();
+    const int64_t min_lbl = *cases_seen.begin();
+    if (max_lbl - min_lbl > std::numeric_limits<int32_t>::max()) {
+      FAIL(stmt, "Out-of-bounds case label range.");
+    }
+  }
+
+  return AsmType::Void();
+}
+
+// 6.6 ValidateCase
+AsmType* AsmTyper::ValidateCase(CaseClause* label) {
+  FlattenedStatements iter(zone_, label->statements());
+  while (auto* current = iter.Next()) {
+    RECURSE(ValidateStatement(current));
+  }
+  return AsmType::Void();
+}
+
+// 6.7 ValidateDefault
+AsmType* AsmTyper::ValidateDefault(CaseClause* label) {
+  FlattenedStatements iter(zone_, label->statements());
+  while (auto* current = iter.Next()) {
+    RECURSE(ValidateStatement(current));
+  }
+  return AsmType::Void();
+}
+
+// 6.8 ValidateExpression
+AsmType* AsmTyper::ValidateExpression(Expression* expr) {
+  switch (expr->node_type()) {
+    default:
+      FAIL(expr, "Invalid ASM.js expression.");
+    case AstNode::kLiteral:
+      return ValidateNumericLiteral(expr->AsLiteral());
+    case AstNode::kVariableProxy:
+      return ValidateIdentifier(expr->AsVariableProxy());
+    case AstNode::kCall:
+      return ValidateCallExpression(expr->AsCall());
+    case AstNode::kProperty:
+      return ValidateMemberExpression(expr->AsProperty());
+    case AstNode::kAssignment:
+      return ValidateAssignmentExpression(expr->AsAssignment());
+    case AstNode::kUnaryOperation:
+      return ValidateUnaryExpression(expr->AsUnaryOperation());
+    case AstNode::kConditional:
+      return ValidateConditionalExpression(expr->AsConditional());
+    case AstNode::kCompareOperation:
+      return ValidateCompareOperation(expr->AsCompareOperation());
+    case AstNode::kBinaryOperation:
+      return ValidateBinaryOperation(expr->AsBinaryOperation());
+  }
+}
+
+AsmType* AsmTyper::ValidateCompareOperation(CompareOperation* cmp) {
+  switch (cmp->op()) {
+    default:
+      FAIL(cmp, "Invalid ASM.js comparison operator.");
+    case Token::LT:
+    case Token::LTE:
+    case Token::GT:
+    case Token::GTE:
+      return ValidateRelationalExpression(cmp);
+    case Token::EQ:
+    case Token::NE:
+      return ValidateEqualityExpression(cmp);
+  }
+
+  UNREACHABLE();
+}
+
+namespace {
+bool MayBeNeg(BinaryOperation* binop) {

[bradnelson, 2016/06/24 00:19:00]

Again, the maybe seems confusing.
(There's places in v8 that use MaybeXXX to indicate XXX or null)

[bradnelson, 2016/06/24 00:19:03]

Probably worth spelling out Negate (to clarify from Negative)

[John, 2016/06/24 17:47:56]

Done.

[John, 2016/06/24 17:47:58]

Acknowledged.

+  if (binop->op() != Token::BIT_XOR) {
+    return false;
+  }
+
+  auto* right_as_literal = binop->right()->AsLiteral();
+  if (right_as_literal == nullptr) {
+    return false;
+  }
+
+  return !right_as_literal->raw_value()->ContainsDot() &&
+         right_as_literal->raw_value()->AsNumber() == -1.0;
+}
+}  // namespace
+
+AsmType* AsmTyper::ValidateBinaryOperation(BinaryOperation* expr) {
+#define UNOP_OVERLOAD(Src, Dest)          \
+  do {                                    \
+    if (left_type->IsA(AsmType::Src())) { \
+      return AsmType::Dest();             \
+    }                                     \
+  } while (0)
+
+  switch (expr->op()) {
+    default:
+      FAIL(expr, "Invalid ASM.js binary expression.");
+    case Token::COMMA:
+      return ValidateCommaExpression(expr);
+    case Token::MUL:
+      if (MayBeDoubleAnnotation(expr)) {
+        // *VIOLATION* We can't be 100% sure this really IS a unary + in the ASM
+        // source so we have to be lenient, and treat this as a unary +.
+        if (auto* Call = expr->left()->AsCall()) {
+          return ValidateCall(AsmType::Double(), Call);
+        }
+        AsmType* left_type;
+        RECURSE(left_type = ValidateExpression(expr->left()));

[bradnelson, 2016/06/24 00:19:01]

Maybe highlight this is from 8.1 for +
What about -x --> x*-1 ?

[John, 2016/06/24 17:47:57]

I did not know the parser would do this... :(

Done.

+        UNOP_OVERLOAD(Signed, Double);
+        UNOP_OVERLOAD(Unsigned, Double);
+        UNOP_OVERLOAD(DoubleQ, Double);
+        UNOP_OVERLOAD(FloatQ, Double);
+        FAIL(expr, "Invalid type for conversion to double.");
+      }
+    // FALTHROUGH
+    case Token::DIV:
+    case Token::MOD:
+      return ValidateMultiplicativeExpression(expr);
+    case Token::ADD:
+    case Token::SUB: {
+      static const uint32_t kInitialIntishCount = 0;
+      return ValidateAdditiveExpression(expr, kInitialIntishCount);
+    }
+    case Token::SAR:
+    case Token::SHL:
+    case Token::SHR:
+      return ValidateShiftExpression(expr);
+    case Token::BIT_AND:
+      return ValidateBitwiseANDExpression(expr);
+    case Token::BIT_XOR:
+      if (MayBeNeg(expr)) {
+        auto* left = expr->left();
+        auto* left_as_binop = left->AsBinaryOperation();
+
+        if (left_as_binop != nullptr && MayBeNeg(left_as_binop)) {
+          // This is the special ~~ operator.
+          AsmType* left_type;
+          RECURSE(left_type = ValidateExpression(left_as_binop->left()));
+          UNOP_OVERLOAD(Double, Signed);
+          UNOP_OVERLOAD(FloatQ, Signed);
+          FAIL(left_as_binop, "Invalid type for conversion to signed.");
+        }
+
+        AsmType* left_type;
+        RECURSE(left_type = ValidateExpression(left));
+        UNOP_OVERLOAD(Intish, Signed);
+        FAIL(left, "Invalid type for ~");
+      }
+
+      return ValidateBitwiseXORExpression(expr);
+    case Token::BIT_OR:
+      return ValidateBitwiseORExpression(expr);
+  }
+#undef UNOP_OVERLOAD
+  UNREACHABLE();
+}
+
+// 6.8.1 Expression
+AsmType* AsmTyper::ValidateCommaExpression(BinaryOperation* comma) {
+  // The AST looks like:
+  // (expr COMMA (expr COMMA (expr COMMA (... ))))
+
+  auto* left = comma->left();
+  auto* left_as_binop = left->AsBinaryOperation();
+  if (left_as_binop && left_as_binop->op() == Token::COMMA) {
+    ValidateCommaExpression(left_as_binop);
+  } else if (auto* left_as_call = left->AsCall()) {
+    ValidateCall(AsmType::Void(), left_as_call);
+  } else {
+    ValidateExpression(left);
+  }
+
+  auto* right = comma->right();
+  auto* right_as_binop = right->AsBinaryOperation();
+  if (right_as_binop && right_as_binop->op() == Token::COMMA) {
+    return ValidateCommaExpression(right_as_binop);
+  } else {
+    return ValidateExpression(right);
+  }
+
+  UNREACHABLE();
+}
+
+// 6.8.2 NumericLiteral
+AsmType* AsmTyper::ValidateNumericLiteral(Literal* literal) {
+  // *VIOLATION* ASM.js does not allow the use of undefined, but our parser
+  // inserts them, so we have to handle them.
+  if (literal->IsUndefinedLiteral()) {
+    return AsmType::Void();
+  }
+
+  if (literal->raw_value()->ContainsDot()) {
+    return AsmType::Double();
+  }
+
+  uint32_t value;
+  if (!literal->value()->ToUint32(&value)) {
+    int32_t value;
+    if (!literal->value()->ToInt32(&value)) {
+      FAIL(literal, "Integer literal is out of range.");
+    }
+    // *VIOLATION* Not really a violation, but rather a different in the
+    // validation. The spec handles -NumericLiteral in ValidateUnaryExpression,
+    // but V8's AST represents the negative literals as Literals.
+    return AsmType::Signed();
+  }
+
+  static const uint32_t LargestFixNum = 0x80000000u - 1;

[bradnelson, 2016/06/24 00:19:01]

You used numeric_limit of int32_t elsewhere for this, probabably should be
consistent.

[John, 2016/06/24 17:47:57]

Done.

+  if (value <= LargestFixNum) {
+    return AsmType::FixNum();
+  }
+
+  return AsmType::Unsigned();
+}
+
+// 6.8.3 Identifier
+AsmType* AsmTyper::ValidateIdentifier(VariableProxy* proxy) {
+  auto* proxy_info = Lookup(proxy->var());
+  if (proxy_info == nullptr) {
+    FAIL(proxy, "Undeclared identifier");
+  }
+  DCHECK(!proxy_info->type()->IsA(AsmType::None()));
+  return proxy_info->type();
+}
+
+// 6.8.4 CallExpression
+AsmType* AsmTyper::ValidateCallExpression(Call* call) {
+  AsmType* return_type;
+  RECURSE(return_type = ValidateFloatCoercion(call));
+  if (return_type == nullptr) {
+    FAIL(call, "Call to fround was expected.");
+  }
+  return return_type;
+}
+
+// 6.8.5 MemberExpression
+AsmType* AsmTyper::ValidateMemberExpression(Property* prop) {
+  AsmType* return_type;
+  RECURSE(return_type = ValidateHeapAccess(prop, LoadFromHeap));
+  return return_type;
+}
+
+// 6.8.6 AssignmentExpression
+AsmType* AsmTyper::ValidateAssignmentExpression(Assignment* assignment) {
+  AsmType* value_type;
+  RECURSE(value_type = ValidateExpression(assignment->value()));
+
+  if (auto* target_as_proxy = assignment->target()->AsVariableProxy()) {
+    auto* var = target_as_proxy->var();
+    auto* target_info = Lookup(var);
+
+    if (target_info == nullptr) {
+      if (var->mode() != TEMPORARY) {
+        FAIL(target_as_proxy, "Undeclared identifier.");
+      }
+      // Temporary variables are special: we add them to the local symbol table
+      // as we see them, with the exact type of the variable's initializer. This
+      // means that temporary variables might have nonsensical types (i.e.,
+      // intish, float?, fixnum, and not just the "canonical" types.)
+      auto* var_info = new (zone_) VariableInfo(value_type);
+      var_info->set_mutability(VariableInfo::kLocal);
+      if (!ValidAsmIdentifier(target_as_proxy->name())) {
+        FAIL(target_as_proxy,
+             "Invalid ASM.js identifier in temporary variable.");
+      }
+
+      if (!AddLocal(var, var_info)) {
+        FAIL(assignment, "Failed to add temporary variable to symbol table.");
+      }
+      return value_type;
+    }
+
+    DCHECK(target_info->type() != AsmType::None());
+    if (!value_type->IsA(target_info->type())) {
+      FAIL(assignment, "Invalid assignment.");
+    }
+
+    return value_type;
+  }
+
+  if (auto* target_as_property = assignment->target()->AsProperty()) {
+    AsmType* allowed_store_types;
+    RECURSE(allowed_store_types =
+                ValidateHeapAccess(target_as_property, StoreToHeap));
+
+    if (!value_type->IsA(allowed_store_types)) {
+      FAIL(assignment, "Invalid assignment.");
+    }
+
+    return value_type;
+  }
+
+  FAIL(assignment, "Invalid ASM.js assignment.");
+}
+
+// 6.8.7 UnaryExpression
+AsmType* AsmTyper::ValidateUnaryExpression(UnaryOperation* unop) {
+  // *VIOLATION* -NumericLiteral is validated in ValidateLiteral.
+  // *VIOLATION* +UnaryExpression is validated in ValidateBinaryOperation.
+  // *VIOLATION* ~UnaryOperation is validated in ValidateBinaryOperation.
+  // *VIOLATION* ~~UnaryOperation is validated in ValidateBinaryOperation.
+  DCHECK(unop->op() != Token::BIT_NOT);
+  DCHECK(unop->op() != Token::ADD);
+  AsmType* exp_type;
+  RECURSE(exp_type = ValidateExpression(unop->expression()));
+#define UNOP_OVERLOAD(Src, Dest)         \
+  do {                                   \
+    if (exp_type->IsA(AsmType::Src())) { \
+      return AsmType::Dest();            \
+    }                                    \
+  } while (0)
+  switch (unop->op()) {
+    default:
+      FAIL(unop, "Invalid unary operator.");

[bradnelson, 2016/06/24 00:19:01]

Minor nit, you're inconsistent about periods at the end of errors (probably
simpler not).

[John, 2016/06/24 17:47:57]

I thought I was being consistent... :(

I like the final '.', so I added the missing ones. For archeology, adding these
to the FAIL macro gives you a compiler-verified list of messages without the
trailing '.':

    static constexpr char m[] = msg;                           \
    static constexpr size_t m_size = arraysize(m);             \
    static constexpr char last_char = msg[m_size - 2];         \
    static_assert(last_char == '.', "");                       \

(hooray for static_assert!)

[bradn, 2016/06/24 18:57:02]

Wow.

+    case Token::ADD:
+      UNOP_OVERLOAD(Signed, Double);

[bradnelson, 2016/06/24 00:19:01]

These are in practice unreachable.
Maybe we should assert the current behavior? Not sure.

[John, 2016/06/24 17:47:58]

Yeah, that's a good idea. I left three DCHECKs behind.

+      UNOP_OVERLOAD(Unsigned, Double);
+      UNOP_OVERLOAD(DoubleQ, Double);
+      UNOP_OVERLOAD(FloatQ, Double);
+      FAIL(unop, "Invalid type for unary +");
+    case Token::SUB:
+      UNOP_OVERLOAD(Int, Intish);
+      UNOP_OVERLOAD(DoubleQ, Double);
+      UNOP_OVERLOAD(FloatQ, Floatish);
+      FAIL(unop, "Invalid type for unary -");
+    case Token::BIT_NOT:
+      UNOP_OVERLOAD(Intish, Signed);
+      FAIL(unop, "Invalid type for ~");
+    case Token::NOT:
+      UNOP_OVERLOAD(Int, Int);
+      FAIL(unop, "Invalid type for !");
+  }
+#undef UNOP_OVERLOAD
+
+  UNREACHABLE();
+}
+
+// 6.8.8 MultiplicativeExpression
+namespace {
+bool IsIntishLiteralFactor(Expression* expr) {
+  auto* literal = expr->AsLiteral();
+  if (literal == nullptr) {
+    return false;
+  }
+
+  if (literal->raw_value()->ContainsDot()) {
+    return false;
+  }
+
+  int32_t value;
+  if (!literal->value()->ToInt32(&value)) {
+    return false;
+  }
+  static const int32_t kIntishBound = 1 << 20;
+  return -kIntishBound < value && value < kIntishBound;
+}
+}  // namespace
+
+AsmType* AsmTyper::ValidateMultiplicativeExpression(BinaryOperation* binop) {
+  DCHECK(!MayBeDoubleAnnotation(binop));
+
+  auto* left = binop->left();
+  auto* right = binop->right();
+
+  if (binop->op() == Token::MUL) {
+    if (IsIntishLiteralFactor(left)) {
+      AsmType* right_type;
+      RECURSE(right_type = ValidateExpression(right));
+      if (right_type->IsA(AsmType::Int())) {
+        return AsmType::Intish();
+      }
+      FAIL(binop, "Invalid types for intish *");
+    }
+
+    if (IsIntishLiteralFactor(right)) {
+      AsmType* left_type;
+      RECURSE(left_type = ValidateExpression(left));
+      if (left_type->IsA(AsmType::Int())) {
+        return AsmType::Intish();
+      }
+      FAIL(binop, "Invalid types for intish *");
+    }
+  }
+
+  AsmType* left_type;
+  AsmType* right_type;
+  RECURSE(left_type = ValidateExpression(left));
+  RECURSE(right_type = ValidateExpression(right));
+
+#define BINOP_OVERLOAD(Src0, Src1, Dest)                                       \
+  do {                                                                         \
+    if (left_type->IsA(AsmType::Src0()) && right_type->IsA(AsmType::Src1())) { \
+      return AsmType::Dest();                                                  \
+    }                                                                          \
+  } while (0)
+  switch (binop->op()) {
+    default:
+      FAIL(binop, "Invalid multiplicative expression.");
+    case Token::MUL:
+      BINOP_OVERLOAD(DoubleQ, DoubleQ, Double);

[bradnelson, 2016/06/24 00:19:00]

Comment referencing table 8.2 ?

[John, 2016/06/24 17:47:56]

Done.

+      BINOP_OVERLOAD(FloatQ, FloatQ, Floatish);
+      FAIL(binop, "Invalida operands for *");

[bradnelson, 2016/06/24 00:19:01]

typo

[John, 2016/06/24 17:47:57]

Done.

+    case Token::DIV:
+      BINOP_OVERLOAD(Signed, Signed, Intish);
+      BINOP_OVERLOAD(Unsigned, Unsigned, Intish);
+      BINOP_OVERLOAD(DoubleQ, DoubleQ, Double);
+      BINOP_OVERLOAD(FloatQ, FloatQ, Floatish);
+      FAIL(binop, "Invalida operands for /");

[bradnelson, 2016/06/24 00:19:03]

typo

[John, 2016/06/24 17:47:57]

Done.

+    case Token::MOD:
+      BINOP_OVERLOAD(Signed, Signed, Intish);
+      BINOP_OVERLOAD(DoubleQ, DoubleQ, Double);
+      BINOP_OVERLOAD(FloatQ, FloatQ, Floatish);
+      FAIL(binop, "Invalida operands for %");

[bradnelson, 2016/06/24 00:19:02]

typo

[John, 2016/06/24 17:47:56]

Done.

+  }
+#undef BINOP_OVERLOAD
+
+  UNREACHABLE();
+}
+
+// 6.8.9 AdditiveExpression
+AsmType* AsmTyper::ValidateAdditiveExpression(BinaryOperation* binop,
+                                              uint32_t intish_count) {
+  static const uint32_t kMaxIntish = 1 << 20;
+
+  auto* left = binop->left();
+  auto* left_as_binop = left->AsBinaryOperation();
+  AsmType* left_type;
+
+  if (left_as_binop != nullptr && (left_as_binop->op() == Token::ADD ||

[bradnelson, 2016/06/24 00:19:01]

Maybe a TODO to consider handling this iteratively?
I suspect in practice the parser is recursive here, but if you really did have
2^20 you'd have a pretty deep stack.

[John, 2016/06/24 17:47:57]

I was going for iterative here, but then I ran into problems because + and -
have different signatures, and thus whenever you validate a term, you need to
know if that term is the lhs of a [+-], or a rhs of a +, or a rhs of a -.

[bradn, 2016/06/24 18:57:03]

Ick. Ok.
I've never seen more than 100s in practice.

+                                   left_as_binop->op() == Token::SUB)) {
+    RECURSE(left_type =
+                ValidateAdditiveExpression(left_as_binop, intish_count + 1));
+  } else {
+    RECURSE(left_type = ValidateExpression(left));
+  }
+
+  auto* right = binop->right();
+  auto* right_as_binop = right->AsBinaryOperation();
+  AsmType* right_type;
+
+  if (right_as_binop != nullptr && (right_as_binop->op() == Token::ADD ||
+                                    right_as_binop->op() == Token::SUB)) {
+    RECURSE(right_type =
+                ValidateAdditiveExpression(right_as_binop, intish_count + 1));
+  } else {
+    RECURSE(right_type = ValidateExpression(right));
+  }
+
+  if (left_type->IsA(AsmType::FloatQ()) && right_type->IsA(AsmType::FloatQ())) {
+    return AsmType::Floatish();
+  }
+
+  if (left_type->IsA(AsmType::Int()) && right_type->IsA(AsmType::Int())) {
+    if (intish_count == 0) {
+      return AsmType::Intish();
+    }
+    if (intish_count < kMaxIntish) {
+      return AsmType::Int();
+    }
+    FAIL(binop, "Too many uncoerced integer additive expressions.");
+  }
+
+  if (left_type->IsA(AsmType::Double()) && right_type->IsA(AsmType::Double())) {
+    return AsmType::Double();
+  }
+
+  if (binop->op() == Token::SUB) {
+    if (left_type->IsA(AsmType::DoubleQ()) &&
+        right_type->IsA(AsmType::DoubleQ())) {
+      return AsmType::Double();
+    }
+  }
+
+  FAIL(binop, "Invalid operands for additive expression.");
+}
+
+// 6.8.10 ShiftExpression
+AsmType* AsmTyper::ValidateShiftExpression(BinaryOperation* binop) {
+  auto* left = binop->left();
+  auto* right = binop->right();
+
+  AsmType* left_type;
+  AsmType* right_type;
+  RECURSE(left_type = ValidateExpression(left));
+  RECURSE(right_type = ValidateExpression(right));
+
+#define BINOP_OVERLOAD(Src0, Src1, Dest)                                       \
+  do {                                                                         \
+    if (left_type->IsA(AsmType::Src0()) && right_type->IsA(AsmType::Src1())) { \
+      return AsmType::Dest();                                                  \
+    }                                                                          \
+  } while (0)
+  switch (binop->op()) {
+    default:
+      FAIL(binop, "Invalid shift expression.");
+    case Token::SHL:
+      BINOP_OVERLOAD(Intish, Intish, Signed);
+      FAIL(binop, "Invalida operands for <<");

[bradnelson, 2016/06/24 00:19:02]

typos

[John, 2016/06/24 17:47:56]

Done.

+    case Token::SAR:
+      BINOP_OVERLOAD(Intish, Intish, Signed);
+      FAIL(binop, "Invalida operands for >>");
+    case Token::SHR:
+      BINOP_OVERLOAD(Intish, Intish, Unsigned);
+      FAIL(binop, "Invalida operands for >>>");
+  }
+#undef BINOP_OVERLOAD
+
+  UNREACHABLE();
+}
+
+// 6.8.11 RelationalExpression
+AsmType* AsmTyper::ValidateRelationalExpression(CompareOperation* cmpop) {
+  auto* left = cmpop->left();
+  auto* right = cmpop->right();
+
+  AsmType* left_type;
+  AsmType* right_type;
+  RECURSE(left_type = ValidateExpression(left));
+  RECURSE(right_type = ValidateExpression(right));
+
+#define CMPOP_OVERLOAD(Src0, Src1, Dest)                                       \
+  do {                                                                         \
+    if (left_type->IsA(AsmType::Src0()) && right_type->IsA(AsmType::Src1())) { \
+      return AsmType::Dest();                                                  \
+    }                                                                          \
+  } while (0)
+  switch (cmpop->op()) {
+    default:
+      FAIL(cmpop, "Invalid relational expression.");
+    case Token::LT:
+      CMPOP_OVERLOAD(Signed, Signed, Int);
+      CMPOP_OVERLOAD(Unsigned, Unsigned, Int);
+      CMPOP_OVERLOAD(Float, Float, Int);
+      CMPOP_OVERLOAD(Double, Double, Int);
+      FAIL(cmpop, "Invalida operands for <");

[bradnelson, 2016/06/24 00:19:02]

typos

[John, 2016/06/24 17:47:58]

Done.

+    case Token::GT:
+      CMPOP_OVERLOAD(Signed, Signed, Int);
+      CMPOP_OVERLOAD(Unsigned, Unsigned, Int);
+      CMPOP_OVERLOAD(Float, Float, Int);
+      CMPOP_OVERLOAD(Double, Double, Int);
+      FAIL(cmpop, "Invalida operands for >");
+    case Token::LTE:
+      CMPOP_OVERLOAD(Signed, Signed, Int);
+      CMPOP_OVERLOAD(Unsigned, Unsigned, Int);
+      CMPOP_OVERLOAD(Float, Float, Int);
+      CMPOP_OVERLOAD(Double, Double, Int);
+      FAIL(cmpop, "Invalida operands for <=");
+    case Token::GTE:
+      CMPOP_OVERLOAD(Signed, Signed, Int);
+      CMPOP_OVERLOAD(Unsigned, Unsigned, Int);
+      CMPOP_OVERLOAD(Float, Float, Int);
+      CMPOP_OVERLOAD(Double, Double, Int);
+      FAIL(cmpop, "Invalida operands for >=");
+  }
+#undef CMPOP_OVERLOAD
+
+  UNREACHABLE();
+}
+
+// 6.8.12 EqualityExpression
+AsmType* AsmTyper::ValidateEqualityExpression(CompareOperation* cmpop) {
+  auto* left = cmpop->left();
+  auto* right = cmpop->right();
+
+  AsmType* left_type;
+  AsmType* right_type;
+  RECURSE(left_type = ValidateExpression(left));
+  RECURSE(right_type = ValidateExpression(right));
+
+#define CMPOP_OVERLOAD(Src0, Src1, Dest)                                       \
+  do {                                                                         \
+    if (left_type->IsA(AsmType::Src0()) && right_type->IsA(AsmType::Src1())) { \
+      return AsmType::Dest();                                                  \
+    }                                                                          \
+  } while (0)
+  switch (cmpop->op()) {
+    default:
+      FAIL(cmpop, "Invalid equality expression.");
+    case Token::EQ:
+      CMPOP_OVERLOAD(Signed, Signed, Int);
+      CMPOP_OVERLOAD(Unsigned, Unsigned, Int);
+      CMPOP_OVERLOAD(Float, Float, Int);
+      CMPOP_OVERLOAD(Double, Double, Int);
+      FAIL(cmpop, "Invalida operands for ==");

[bradnelson, 2016/06/24 00:19:03]

typos

[John, 2016/06/24 17:47:57]

Done.

+    case Token::NE:
+      CMPOP_OVERLOAD(Signed, Signed, Int);
+      CMPOP_OVERLOAD(Unsigned, Unsigned, Int);
+      CMPOP_OVERLOAD(Float, Float, Int);
+      CMPOP_OVERLOAD(Double, Double, Int);
+      FAIL(cmpop, "Invalida operands for !=");
+  }
+#undef CMPOP_OVERLOAD
+
+  UNREACHABLE();
+}
+
+// 6.8.13 BitwiseANDExpression
+AsmType* AsmTyper::ValidateBitwiseANDExpression(BinaryOperation* binop) {
+  auto* left = binop->left();
+  auto* right = binop->right();
+
+  AsmType* left_type;
+  AsmType* right_type;
+  RECURSE(left_type = ValidateExpression(left));
+  RECURSE(right_type = ValidateExpression(right));
+
+  if (binop->op() != Token::BIT_AND) {
+    FAIL(binop, "Invalid & expression.");
+  }
+
+#define BINOP_OVERLOAD(Src0, Src1, Dest)                                       \
+  do {                                                                         \
+    if (left_type->IsA(AsmType::Src0()) && right_type->IsA(AsmType::Src1())) { \
+      return AsmType::Dest();                                                  \
+    }                                                                          \
+  } while (0)
+  BINOP_OVERLOAD(Intish, Intish, Signed);
+  FAIL(binop, "Invalida operands for &");
+#undef BINOP_OVERLOAD
+
+  UNREACHABLE();
+}
+
+// 6.8.14 BitwiseXORExpression
+AsmType* AsmTyper::ValidateBitwiseXORExpression(BinaryOperation* binop) {
+  auto* left = binop->left();
+  auto* right = binop->right();
+
+  AsmType* left_type;
+  AsmType* right_type;
+  RECURSE(left_type = ValidateExpression(left));
+  RECURSE(right_type = ValidateExpression(right));
+
+  if (binop->op() != Token::BIT_XOR) {
+    FAIL(binop, "Invalid ^ expression.");
+  }
+
+#define BINOP_OVERLOAD(Src0, Src1, Dest)                                       \
+  do {                                                                         \
+    if (left_type->IsA(AsmType::Src0()) && right_type->IsA(AsmType::Src1())) { \
+      return AsmType::Dest();                                                  \
+    }                                                                          \
+  } while (0)
+  BINOP_OVERLOAD(Intish, Intish, Signed);
+  FAIL(binop, "Invalida operands for ^");
+#undef BINOP_OVERLOAD
+
+  UNREACHABLE();
+}
+
+// 6.8.15 BitwiseORExpression
+AsmType* AsmTyper::ValidateBitwiseORExpression(BinaryOperation* binop) {
+  auto* left = binop->left();
+  if (IsIntAnnotation(binop)) {

[bradnelson, 2016/06/24 00:19:02]

Maybe comment this peeks in twice?

[John, 2016/06/24 17:47:57]

Done.

+    if (auto* left_as_call = left->AsCall()) {
+      AsmType* type;
+      RECURSE(type = ValidateCall(AsmType::Signed(), left_as_call));
+      return type;
+    }
+  }
+
+  auto* right = binop->right();
+  AsmType* left_type;
+  AsmType* right_type;
+  RECURSE(left_type = ValidateExpression(left));
+  RECURSE(right_type = ValidateExpression(right));
+
+  if (binop->op() != Token::BIT_XOR) {
+    FAIL(binop, "Invalid ^ expression.");
+  }
+
+#define BINOP_OVERLOAD(Src0, Src1, Dest)                                       \
+  do {                                                                         \
+    if (left_type->IsA(AsmType::Src0()) && right_type->IsA(AsmType::Src1())) { \
+      return AsmType::Dest();                                                  \
+    }                                                                          \
+  } while (0)
+  BINOP_OVERLOAD(Intish, Intish, Signed);
+  FAIL(binop, "Invalida operands for ^");
+#undef BINOP_OVERLOAD
+
+  UNREACHABLE();
+}
+
+// 6.8.16 ContionalExpression
+AsmType* AsmTyper::ValidateConditionalExpression(Conditional* cond) {
+  AsmType* cond_type;
+  RECURSE(cond_type = ValidateExpression(cond->condition()));
+  if (!cond_type->IsA(AsmType::Int())) {
+    FAIL(cond, "Ternary operation condition should be int.");
+  }
+
+  AsmType* then_type;
+  RECURSE(then_type = ValidateExpression(cond->then_expression()));
+  AsmType* else_type;
+  RECURSE(else_type = ValidateExpression(cond->else_expression()));
+
+#define SUCCEED_IF_BOTH_ARE(type)                                       \
+  do {                                                                  \
+    if (then_type->IsA(AsmType::type())) {                              \
+      if (!else_type->IsA(AsmType::type())) {                           \
+        FAIL(cond, "Type mismatch for ternary operation result type."); \
+      }                                                                 \
+    }                                                                   \
+  } while (0)
+  SUCCEED_IF_BOTH_ARE(Int);
+  SUCCEED_IF_BOTH_ARE(Float);
+  SUCCEED_IF_BOTH_ARE(Double);
+#undef SUCCEED_IF_BOTH_ARE
+
+  FAIL(cond, "Ternary operator must return int, float, or double.");
+}
+
+// 6.9 ValidateCall
+namespace {
+bool ExtractIndirectCallMask(Expression* expr, uint32_t* value) {
+  auto* as_literal = expr->AsLiteral();
+  if (as_literal == nullptr) {
+    return false;
+  }
+
+  if (as_literal->raw_value()->ContainsDot()) {
+    return false;
+  }
+
+  if (!as_literal->value()->ToUint32(value)) {
+    return false;
+  }
+
+  return base::bits::IsPowerOfTwo32(1 + *value);

[bradnelson, 2016/06/24 00:19:01]

This will do the wrong thing for 2^31, no?

[John, 2016/06/24 17:47:58]

IsPowerOfTwo32(2 ^ 31) ===
  return (2 ^ 31) && !((2 ^ 31) & ((2 ^ 31) - 1)) ===
  return true && !(false)

So I believe it does the right thing here?

[bradn, 2016/06/24 18:57:03]

Sorry meant 2^32 - 1

+}
+}  // namespace
+
+AsmType* AsmTyper::ValidateCall(AsmType* return_type, Call* call) {
+  AsmType* float_coercion_type;
+  RECURSE(float_coercion_type = ValidateFloatCoercion(call));
+  if (float_coercion_type == AsmType::Float()) {
+    return AsmType::Float();
+  }
+
+  auto* call_type = AsmType::Function(zone_, return_type)->AsFunctionType();
+  for (auto* arg : *call->arguments()) {
+    AsmType* arg_type;
+    RECURSE(arg_type = ValidateExpression(arg));
+    call_type->AddArgument(arg_type->ToParameterType());
+  }
+
+  auto* call_expr = call->expression();
+
+  // identifier(Expression...)
+  if (auto* call_var_proxy = call_expr->AsVariableProxy()) {
+    auto* call_var_info = Lookup(call_var_proxy->var());
+
+    if (call_var_info == nullptr) {
+      // We can't fail here: the validator performs a single pass over the AST,
+      // so it is possible for some calls to be currently unresolved. We eagerly
+      // add the function to the table of globals.
+      auto* fun_info =
+          new (zone_) VariableInfo(reinterpret_cast<AsmType*>(call_type));
+      fun_info->set_mutability(VariableInfo::kImmutableGlobal);
+      AddForwardReference(call_var_proxy, fun_info);
+      if (!ValidAsmIdentifier(call_var_proxy->name())) {
+        FAIL(call_var_proxy,
+             "Invalid ASM.js identifier in (forward) function name.");
+      }
+      if (!AddGlobal(call_var_proxy->var(), fun_info)) {
+        DCHECK(false);
+        FAIL(call, "Redeclared global identifier");
+      }
+      return return_type;
+    }
+
+    auto* callee_type = call_var_info->type()->AsCallableType();
+    if (callee_type == nullptr) {
+      FAIL(call, "Calling something that's not a function.");
+    }
+
+    if (callee_type->AsFFIType() != nullptr &&
+        return_type == AsmType::Float()) {
+      FAIL(call, "FFI functions can't return float.");
+    }
+
+    if (callee_type->ValidateCall(call_type->ReturnType(),
+                                  call_type->Arguments()) == AsmType::None()) {
+      FAIL(call, "Argument type mismatch.");
+    }
+
+    return return_type;
+  }
+
+  // identifier[expr & n](Expression...)
+  if (auto* call_property = call_expr->AsProperty()) {
+    auto* index = call_property->key()->AsBinaryOperation();
+    if (index == nullptr || index->op() != Token::BIT_AND) {
+      FAIL(index, "Indirect call index must be in the expr & mask form");
+    }
+
+    auto* right = index->right();
+    uint32_t mask;
+    if (!ExtractIndirectCallMask(right, &mask)) {
+      FAIL(right, "Invalid indirect call mask");
+    }
+    auto* table_type = AsmType::FunctionTableType(
+        zone_, mask + 1, reinterpret_cast<AsmType*>(call_type));
+
+    auto* left = index->left();
+    AsmType* left_type;
+    RECURSE(left_type = ValidateExpression(left));
+    if (!left_type->IsA(AsmType::Intish())) {
+      FAIL(left, "Indirect call index should be an intish.");
+    }
+
+    auto* name_var = call_property->obj()->AsVariableProxy();
+
+    if (name_var == nullptr) {
+      FAIL(call_property, "Invalid call.");
+    }
+
+    auto* name_info = Lookup(name_var->var());
+    if (name_info == nullptr) {
+      // We can't fail here -- just like above.
+      auto* fun_info =
+          new (zone_) VariableInfo(reinterpret_cast<AsmType*>(table_type));
+      fun_info->set_mutability(VariableInfo::kImmutableGlobal);
+      AddForwardReference(name_var, fun_info);
+      if (!ValidAsmIdentifier(name_var->name())) {
+        FAIL(name_var,
+             "Invalid ASM.js identifier in (forward) function table name.");
+      }
+      if (!AddGlobal(name_var->var(), fun_info)) {
+        DCHECK(false);
+        FAIL(call, "Redeclared global identifier.");
+      }
+      return return_type;
+    }
+
+    auto* previous_type = name_info->type()->AsFunctionTableType();
+    if (previous_type == nullptr) {
+      FAIL(call, "Expression type does not match previous type");
+    }
+
+    auto* table_type_as_function_table = table_type->AsFunctionTableType();
+    if (table_type_as_function_table->length() != previous_type->length()) {
+      FAIL(call, "Function table size does not previous size.");
+    }
+
+    auto* previous_type_signature =
+        previous_type->signature()->AsFunctionType();
+    if (call_type->ValidateCall(previous_type_signature->ReturnType(),
+                                previous_type_signature->Arguments()) ==
+        AsmType::None()) {
+      FAIL(call,
+           "Function pointer table signature does not match previous "
+           "signature.");
+    }
+
+    return return_type;
+  }
+
+  FAIL(call, "Invalid call.");
+}
+
+// 6.10 ValidateHeapAccess
+namespace {
+bool ExtractHeapAccessShift(Expression* expr, uint32_t* value) {
+  auto* as_literal = expr->AsLiteral();
+  if (as_literal == nullptr) {
+    return false;
+  }
+
+  if (as_literal->raw_value()->ContainsDot()) {
+    return false;
+  }
+
+  return as_literal->value()->ToUint32(value);
+}
+}  // namespace
+
+AsmType* AsmTyper::ValidateHeapAccess(Property* heap,
+                                      HeapAccessType access_type) {
+  auto* obj = heap->obj()->AsVariableProxy();
+  if (obj == nullptr) {
+    FAIL(heap, "Invalid heap access.");
+  }
+
+  auto* obj_info = Lookup(obj->var());
+  if (obj_info == nullptr) {
+    FAIL(heap, "Undeclared identifier.");
+  }
+
+  auto* obj_type = obj_info->type();
+  if (!obj_type->IsA(AsmType::Heap())) {
+    FAIL(heap, "Identifier does not represent a heap view.");
+  }
+
+  if (auto* key_as_literal = heap->key()->AsLiteral()) {
+    if (key_as_literal->raw_value()->ContainsDot()) {
+      FAIL(key_as_literal, "Heap access index must be intish");
+    }
+
+    uint32_t _;
+    if (!key_as_literal->value()->ToUint32(&_)) {
+      FAIL(key_as_literal,
+           "Heap access index must be a 32-bit unsigned integer.");
+    }
+
+    if (access_type == LoadFromHeap) {
+      return obj_type->LoadType();
+    }
+    return obj_type->StoreType();
+  }
+
+  if (auto* key_as_binop = heap->key()->AsBinaryOperation()) {
+    uint32_t shift;
+    if (key_as_binop->op() == Token::SAR &&
+        ExtractHeapAccessShift(key_as_binop->right(), &shift) &&
+        (1 << shift) == obj_type->ElementSizeInBytes()) {
+      AsmType* type;
+      RECURSE(type = ValidateExpression(key_as_binop->left()));
+      if (type->IsA(AsmType::Intish())) {
+        if (access_type == LoadFromHeap) {
+          return obj_type->LoadType();
+        }
+        return obj_type->StoreType();
+      }
+    }
+  }
+
+  if (obj_type->ElementSizeInBytes() == 1) {
+    // Leniency: if this is a byte array, we don't require the shift operation
+    // to be present.
+    AsmType* index_type;
+    RECURSE(index_type = ValidateExpression(heap->key()));
+    if (!index_type->IsA(AsmType::Intish())) {
+      FAIL(heap, "Invalid heap access index for byte array.");
+    }
+  }
+
+  FAIL(heap, "Invalid heap access index.");
+}
+
+// 6.11 ValidateFloatCoercion
+bool AsmTyper::IsCallToFround(Call* call) {
+  if (call->arguments()->length() != 1) {
+    return false;
+  }
+
+  auto* call_var_proxy = call->expression()->AsVariableProxy();
+  if (call_var_proxy == nullptr) {
+    return false;
+  }
+
+  auto* call_var_info = Lookup(call_var_proxy->var());
+  if (call_var_info == nullptr) {
+    return false;
+  }
+
+  return call_var_info->standard_member() == kMathFround;
+}
+
+AsmType* AsmTyper::ValidateFloatCoercion(Call* call) {
+  if (!IsCallToFround(call)) {
+    return nullptr;
+  }
+
+  auto* arg = call->arguments()->at(0);
+  // call is a fround() node. From now, there can be two possible outcomes:
+  // 1. fround is used as a return type annotation.
+  if (auto* arg_as_call = arg->AsCall()) {
+    RECURSE(ValidateCall(AsmType::Float(), arg_as_call));
+    return AsmType::Float();
+  }
+
+  // 2. fround is used for converting to float.
+  AsmType* arg_type;
+  RECURSE(arg_type = ValidateExpression(arg));
+  if (arg_type->IsA(AsmType::Floatish()) || arg_type->IsA(AsmType::DoubleQ()) ||
+      arg_type->IsA(AsmType::Signed()) || arg_type->IsA(AsmType::Unsigned())) {
+    return AsmType::Float();
+  }
+
+  FAIL(call, "Invalid argument type to fround.");
+}
+
+// 5.1 ParameterTypeAnnotations
+AsmType* AsmTyper::ParameterTypeAnnotations(Variable* parameter,
+                                            Expression* annotation) {
+  if (auto* binop = annotation->AsBinaryOperation()) {
+    // Must be:
+    //   * x|0
+    //   * x*1 (*VIOLATION* i.e.,, +x)
+    auto* left = binop->left()->AsVariableProxy();
+    if (left == nullptr) {
+      FAIL(binop->left(), "Invalid parameter type annotation");
+    }
+    if (left->var() != parameter) {
+      FAIL(binop->left(), "Invalid parameter type annotation");
+    }
+    auto* right = binop->right()->AsLiteral();
+    if (right == nullptr) {
+      FAIL(binop->left(), "Invalid parameter type annotation");
+    }
+    switch (binop->op()) {
+      default:
+        FAIL(binop->left(), "Invalid parameter type annotation");
+      case Token::MUL:
+        if (right->raw_value()->ContainsDot() &&
+            right->raw_value()->AsNumber() == 1.0) {
+          return AsmType::Double();
+        }
+        FAIL(binop, "Invalid parameter type annotation");
+      case Token::BIT_OR:
+        if (!right->raw_value()->ContainsDot() &&
+            right->raw_value()->AsNumber() == 0.0) {
+          return AsmType::Int();
+        }
+        FAIL(binop, "Invalid parameter type annotation");
+    }
+  }
+
+  auto* call = annotation->AsCall();
+  if (call == nullptr) {
+    FAIL(annotation, "Invalid float parameter type annotation.");
+  }
+
+  if (call->arguments()->length() != 1) {
+    FAIL(annotation, "Invalid float parameter type annotation.");
+  }
+
+  auto* src_expr = call->arguments()->at(0)->AsVariableProxy();
+  if (src_expr == nullptr) {
+    FAIL(annotation, "Invalid float parameter type annotation.");
+  }
+
+  if (src_expr->var() != parameter) {
+    FAIL(annotation, "Invalid float parameter type annotation.");
+  }
+
+  auto* call_var_proxy = call->expression()->AsVariableProxy();
+  if (call_var_proxy == nullptr) {
+    FAIL(annotation, "Invalid float parameter type annotation.");
+  }
+
+  auto* call_var_info = Lookup(call_var_proxy->var());

[bradnelson, 2016/06/24 00:19:03]

Isn't this one a DCHECK?

[John, 2016/06/24 17:47:57]

I don't think so. Why?

[bradn, 2016/06/24 18:57:03]

Oh wait, nevermind, you're right.

+  if (call_var_info == nullptr) {
+    FAIL(annotation, "Invalid float parameter type annotation.");
+  }
+
+  if (call_var_info->standard_member() != kMathFround) {
+    FAIL(annotation, "Invalid float parameter type annotation.");
+  }
+
+  return AsmType::Float();
+}
+
+// 5.2 ReturnTypeAnnotations
+AsmType* AsmTyper::ReturnTypeAnnotations(ReturnStatement* statement) {
+  if (statement == nullptr) {
+    return AsmType::Void();
+  }
+
+  auto* ret_expr = statement->expression();
+  if (ret_expr == nullptr) {
+    return AsmType::Void();
+  }
+
+  if (auto* binop = ret_expr->AsBinaryOperation()) {
+    if (MayBeDoubleAnnotation(binop)) {
+      return AsmType::Double();
+    } else if (IsIntAnnotation(binop)) {
+      return AsmType::Signed();
+    }
+    FAIL(statement, "Invalid return type annotation.");
+  }
+
+  if (auto* call = ret_expr->AsCall()) {
+    if (IsCallToFround(call)) {
+      return AsmType::Float();
+    }
+    FAIL(statement, "Invalid function call in return statement.");
+  }
+
+  if (auto* literal = ret_expr->AsLiteral()) {
+    int32_t _;
+    if (literal->raw_value()->ContainsDot()) {
+      return AsmType::Double();
+    } else if (literal->value()->ToInt32(&_)) {
+      return AsmType::Signed();
+    } else if (literal->IsUndefinedLiteral()) {
+      // *VIOLATION* The parser changes
+      //
+      // return;
+      //
+      // into
+      //
+      // return undefined
+      return AsmType::Void();
+    }
+    FAIL(statement, "Invalid literal in return statement.");
+  }
+
+  FAIL(statement, "Invalid return type expression.");
+}
+
+// 5.4 VariableTypeAnnotations
+// Also used for 5.5 GlobalVariableTypeAnnotations
+AsmType* AsmTyper::VariableTypeAnnotations(Expression* initializer) {
+  if (auto* literal = initializer->AsLiteral()) {
+    if (literal->raw_value()->ContainsDot()) {
+      return AsmType::Double();
+    }
+    int32_t i32;
+    uint32_t u32;
+    if (literal->value()->ToInt32(&i32) || literal->value()->ToUint32(&u32)) {
+      return AsmType::Int();
+    }
+    FAIL(initializer, "Invalid type annotation - forbidden literal.");
+  }
+
+  auto* call = initializer->AsCall();
+  DCHECK(call != nullptr);
+  if (call == nullptr) {
+    FAIL(initializer,
+         "Invalid variable initialization - it should be a literal, or "
+         "fround(literal).");
+  }
+
+  if (!IsCallToFround(call)) {
+    FAIL(initializer,
+         "Invalid float coercion - expected call fround(literal).");
+  }
+
+  auto* src_expr = call->arguments()->at(0)->AsLiteral();
+  if (src_expr == nullptr) {
+    FAIL(initializer,
+         "Invalid float type annotation - expected literal argument for call "
+         "to fround.");
+  }
+
+  if (!src_expr->raw_value()->ContainsDot()) {
+    FAIL(initializer,
+         "Invalid float type annotation - expected literal argument to be a "
+         "floating point literal.");
+  }
+
+  return AsmType::Float();
+}
+
+// 5.5 GlobalVariableTypeAnnotations
+AsmType* AsmTyper::NewHeapView(CallNew* new_heap_view) {
+  auto* heap_type = new_heap_view->expression()->AsProperty();
+  if (heap_type == nullptr) {
+    FAIL(new_heap_view, "Invalid type after new.");
+  }
+  auto* heap_view_info = ImportLookup(heap_type);
+
+  if (heap_view_info == nullptr) {
+    FAIL(new_heap_view, "Unknown stdlib member in heap view declaration.");
+  }
+
+  if (!heap_view_info->type()->IsA(AsmType::Heap())) {
+    FAIL(new_heap_view, "Type is not a heap view type.");
+  }
+
+  if (new_heap_view->arguments()->length() != 1) {
+    FAIL(new_heap_view, "Invalid number of arguments when creating heap view.");
+  }
+
+  auto* heap = new_heap_view->arguments()->at(0);
+  auto* heap_var_proxy = heap->AsVariableProxy();
+
+  if (heap_var_proxy == nullptr) {
+    FAIL(heap,
+         "Heap view creation parameter should be the module's heap parameter.");
+  }
+
+  auto* heap_var_info = Lookup(heap_var_proxy->var());
+
+  if (heap_var_info == nullptr) {
+    FAIL(heap, "Undeclared identifier instead of heap parameter.");
+  }
+
+  if (!heap_var_info->IsHeap()) {
+    FAIL(heap,
+         "Heap view creation parameter should be the module's heap parameter.");
+  }
+
+  DCHECK(heap_view_info->type()->IsA(AsmType::Heap()));
+  return heap_view_info->type();
+}
+
+bool IsValidAsm(Isolate* isolate, Zone* zone, Script* script,
+                FunctionLiteral* root, std::string* error_message) {
+  error_message->clear();
+
+  AsmTyper typer(isolate, zone, script, root);
+  if (typer.Validate()) {
+    return true;
+  }
+
+  *error_message = typer.error_message();
+  return false;
+}
+
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8