[wasm][asm.js] Require a number for fround literals.

BUG=673240
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2565343002
Cr-Commit-Position: refs/heads/master@{#41643}

src/asmjs/asm-typer.cc

@@ -2858,6 +2858,12 @@ AsmType* AsmTyper::VariableTypeAnnotations(
   // However, the errata doc (and actual programs), use integer values
   // with fround(..).
   // Skipping the check that would go here to enforce this.
+  // Checking instead the literal expression is at least a number.
+  if (!src_expr->raw_value()->IsNumber()) {
+    FAIL(initializer,
+         "Invalid float type annotation - expected numeric literal for call "
+         "to fround.");
+  }
 
   return AsmType::Float();
 }

test/mjsunit/asm/asm-validation.js

@@ -344,6 +344,21 @@ function assertValidAsm(func) {
   assertEquals(4, m.foo(3));
 })();
 
+(function TestBadFroundTrue() {
+  function Module(stdlib) {
+    "use asm";
+    var fround = stdlib.Math.fround;
+    function foo() {
+      var x = fround(true);
+      return +x;
+    }
+    return { foo: foo };
+  }
+  var m = Module(this);
+  assertFalse(%IsAsmWasmCode(Module));
+  assertEquals(1, m.foo());
+})();
+
 (function TestBadCase() {
   function Module() {
     "use asm";