[Asm.js] Prevents assignments to immutables.

src/asmjs/asm-typer.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/asmjs/asm-typer.h"
 
 #include <algorithm>
 #include <limits>
 #include <memory>
 #include <string>
@@ skipping 1726 matching lines @@
         FAIL(target_as_proxy,
              "Invalid asm.js identifier in temporary variable.");
       }
 
       if (!AddLocal(var, var_info)) {
         FAIL(assignment, "Failed to add temporary variable to symbol table.");
       }
       return value_type;
     }
 
-    DCHECK(target_info->type() != AsmType::None());
+    if (!target_info->IsMutable()) {
+      FAIL(assignment, "Can't assign to immutable symbol.");
+    }
+
+    DCHECK_NE(AsmType::None(), target_info->type());
     if (!value_type->IsA(target_info->type())) {
       FAIL(assignment, "Type mismatch in assignment.");
     }
 
     return value_type;
   }
 
   if (auto* target_as_property = assignment->target()->AsProperty()) {
     AsmType* allowed_store_types;
     RECURSE(allowed_store_types =
@@ skipping 1002 matching lines @@
     return true;
   }
 
   *error_message = typer.error_message();
   return false;
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8