[wasm][asm.js] Allow true/false in int binary ops.

test/mjsunit/asm/asm-validation.js

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --validate-asm --allow-natives-syntax
 
 // Note that this test file contains tests that explicitly check modules are
 // valid asm.js and then break them with invalid instantiation arguments. If
 // this script is run more than once (e.g. --stress-opt) then modules remain
 // broken in the second run and assertions would fail. We prevent re-runs.
@@ skipping 284 matching lines @@
     "use asm";
     const i = 0xffffffff;
     function foo() { return i; }
     return { foo: foo };
   }
   var m = Module();
   assertFalse(%IsAsmWasmCode(Module));
   assertEquals(0xffffffff, m.foo());
 })();
 
-(function TestBadBooleanAnnotation() {
+(function TestBadBooleanParamAnnotation() {
   function Module() {
     "use asm";
     function foo(x) {
       x = x | true;
       return x;
     }
     return { foo: foo };
   }
   var m = Module();
   assertFalse(%IsAsmWasmCode(Module));
   assertEquals(3, m.foo(3));
 })();
 
+(function TestBadishBooleanExprAnnotation() {
+  function Module() {
+    "use asm";
+    function foo(x) {
+      x = x | 0;
+      x = (x + 1) | false;
+      return x | 0;
+    }
+    return { foo: foo };
+  }
+  var m = Module();
+  // We all false here because the parser optimizes expressons like:
+  // !123 to false.
+  assertTrue(%IsAsmWasmCode(Module));
+  assertEquals(4, m.foo(3));
+})();
+
 (function TestBadCase() {
   function Module() {
     "use asm";
     function foo(x) {
       x = x | 0;
       switch (x|0) {
         case true:
           return 42;
         default:
           return 43;
       }
       return 0;
     }
     return { foo: foo };
   }
   var m = Module();
   assertFalse(%IsAsmWasmCode(Module));
   assertEquals(43, m.foo(3));
 })();