[wasm] [asm.js] Don't allow bad return types from a global constant

test/mjsunit/asm/asm-validation.js

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --validate-asm --allow-natives-syntax
 
 function assertValidAsm(func) {
   assertTrue(%IsAsmWasmCode(func));
 }
 
@@ skipping 265 matching lines @@
     "use asm";
     function foo() { return 123; }
     return { foo: foo };
   }
   var heap = new ArrayBuffer(1024 * 1024);
   var ModuleBound = Module.bind(this, {}, {}, heap);
   var m = ModuleBound();
   assertValidAsm(Module);
   assertEquals(123, m.foo());
 })();
+
+(function TestBadConstUnsignedReturn() {
+  function Module() {
+    "use asm";
+    const i = 0xffffffff;
+    function foo() { return i; }
+    return { foo: foo };
+  }
+  var m = Module();
+  assertTrue(%IsNotAsmWasmCode(Module));
+  assertEquals(0xffffffff, m.foo());
+})();