[wasm][asm.js] Forbid function declaration replacing variable declaration.

src/asmjs/asm-typer.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/asmjs/asm-typer.h"
 
 #include <algorithm>
 #include <limits>
 #include <memory>
 #include <string>
@@ skipping 927 matching lines @@
   }
 
   if (type->AsFunctionTableType() != nullptr) {
     FAIL(fun_export, "Module cannot export function tables.");
   }
 
   if (fun_info->type()->AsFunctionType() == nullptr) {
     FAIL(fun_export, "Module export is not an asm.js function.");
   }
 
+  if (!fun_export->var()->is_function()) {
+    FAIL(fun_export, "Module exports must be function declarations.");
+  }
+
   return type;
 }
 
 AsmType* AsmTyper::ValidateExport(ReturnStatement* exports) {
   // asm.js modules can export single functions, or multiple functions in an
   // object literal.
   if (auto* fun_export = exports->expression()->AsVariableProxy()) {
     // Exporting single function.
     AsmType* export_type;
     RECURSE(export_type = ExportType(fun_export));
@@ skipping 1952 matching lines @@
     return true;
   }
 
   *error_message = typer.error_message();
   return false;
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8