[wasm][asm.js] Permit ternary operator in asm.js returns in some cases.

test/mjsunit/asm/asm-validation.js

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --validate-asm --allow-natives-syntax
 
 // Note that this test file contains tests that explicitly check modules are
 // valid asm.js and then break them with invalid instantiation arguments. If
 // this script is run more than once (e.g. --stress-opt) then modules remain
 // broken in the second run and assertions would fail. We prevent re-runs.
@@ skipping 395 matching lines @@
   function Module() {
     "use asm";
     function foo() {
       return bar() | 0;
     }
     return foo;
   }
   Module();
   assertFalse(%IsAsmWasmCode(Module));
 })();
+
+(function TestConditionalReturn() {
+  function Module() {
+    'use asm';
+    function foo(a, b) {
+      a = +a;
+      b = +b;
+      // Allowed, despite not matching the spec, as emscripten emits this in
+      // practice.
+      return a == b ? +a : +b;
+    }
+    return foo;
+  }
+  var m = Module();
+  assertEquals(4, m(4, 4));
+  assertEquals(5, m(4, 5));
+  assertEquals(4, m(5, 4));
+  assertValidAsm(Module);
+})();
+
+(function TestMismatchedConditionalReturn() {
+  function Module() {
+    'use asm';
+    function foo(a, b) {
+      a = +a;
+      return a == 0.0 ? 0 : +a;
+    }
+    return foo;
+  }
+  Module();
+  assertFalse(% IsAsmWasmCode(Module));
+})();
+
+(function TestBadIntConditionalReturn() {
+  function Module() {
+    'use asm';
+    function foo(a, b) {
+      a = a | 0;
+      b = b | 0;
+      // Disallowed because signature must be signed, but these will be int.
+      return 1 ? a : b;
+    }
+    return foo;
+  }
+  Module();
+  assertFalse(% IsAsmWasmCode(Module));
+})();
+
+(function TestBadSignedConditionalReturn() {
+  function Module() {
+    'use asm';
+    function foo(a, b) {
+      a = a | 0;
+      b = b | 0;
+      // Disallowed because conditional yields int, even when both sides
+      // are signed.
+      return 1 ? a | 0 : b | 0;
+    }
+    return foo;
+  }
+  Module();
+  assertFalse(% IsAsmWasmCode(Module));
+})();