[wasm][asm.js] Check if a property key is a PropertyName before assumming it.

src/asmjs/asm-typer.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/asmjs/asm-typer.h"
 
 #include <algorithm>
 #include <limits>
 #include <memory>
 #include <string>
@@ skipping 367 matching lines @@
   auto* obj_info = Lookup(obj_as_var_proxy->var());
   if (obj_info == nullptr) {
     return nullptr;
   }
 
   if (obj_info->IsFFI()) {
     // For FFI we can't validate import->key, so assume this is OK.
     return obj_info;
   }
 
+  if (!key->IsPropertyName()) {
+    return nullptr;
+  }
+
   std::unique_ptr<char[]> aname = key->AsPropertyName()->ToCString();
   ObjectTypeMap::iterator i = stdlib->find(std::string(aname.get()));
   if (i == stdlib->end()) {
     return nullptr;
   }
   stdlib_uses_.insert(i->second->standard_member());
   return i->second;
 }
 
 AsmTyper::VariableInfo* AsmTyper::Lookup(Variable* variable) const {
@@ skipping 2536 matching lines @@
          "Heap view creation parameter should be the module's heap parameter.");
   }
 
   DCHECK(heap_view_info->type()->IsA(AsmType::Heap()));
   return heap_view_info->type();
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8