[wasm] [asm.js] Don't allow bad return types from a global constant

src/asmjs/asm-typer.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/asmjs/asm-typer.h"
 
 #include <algorithm>
 #include <limits>
 #include <memory>
 #include <string>
@@ skipping 2695 matching lines @@
     auto* var_info = Lookup(proxy->var());
 
     if (var_info == nullptr) {
       FAIL(statement, "Undeclared identifier in return statement.");
     }
 
     if (var_info->mutability() != VariableInfo::kConstGlobal) {
       FAIL(statement, "Identifier in return statement is not const.");
     }
 
+    if (!var_info->type()->IsReturnType()) {
+      FAIL(statement, "Constant in return must be signed, float, or double.");
+    }
+
     return var_info->type();
   }
 
   FAIL(statement, "Invalid return type expression.");
 }
 
 // 5.4 VariableTypeAnnotations
 // Also used for 5.5 GlobalVariableTypeAnnotations
 AsmType* AsmTyper::VariableTypeAnnotations(
     Expression* initializer, VariableInfo::Mutability mutability_type) {
@@ skipping 127 matching lines @@
     return true;
   }
 
   *error_message = typer.error_message();
   return false;
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8