[V8][asm.js] Fixes a bug in comma-expression validation.

src/asmjs/asm-typer.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/asmjs/asm-typer.h"
 
 #include <algorithm>
 #include <limits>
 #include <memory>
 #include <string>
@@ skipping 1624 matching lines @@
   auto* left = comma->left();
   if (auto* left_as_call = left->AsCall()) {
     RECURSE(ValidateCall(AsmType::Void(), left_as_call));
   } else {
     RECURSE(ValidateExpression(left));
   }
 
   auto* right = comma->right();
   AsmType* right_type = nullptr;
   if (auto* right_as_call = right->AsCall()) {
-    RECURSE(right_type = ValidateCall(AsmType::Void(), right_as_call));
+    RECURSE(right_type = ValidateFloatCoercion(right_as_call));
+    if (right_type != AsmType::Float()) {
+      // right_type == nullptr <-> right_as_call is not a call to fround.
+      DCHECK(right_type == nullptr);
+      RECURSE(right_type = ValidateCall(AsmType::Void(), right_as_call));
+      // Unnanotated function call to something that's not fround must be a call
+      // to a void function.
+      DCHECK_EQ(right_type, AsmType::Void());
+    }
   } else {
     RECURSE(right_type = ValidateExpression(right));
   }
 
   return right_type;
 }
 
 // 6.8.2 NumericLiteral
 AsmType* AsmTyper::ValidateNumericLiteral(Literal* literal) {
   // *VIOLATION* asm.js does not allow the use of undefined, but our parser
@@ skipping 11 matching lines @@
   if (literal->raw_value()->IsTrue() || literal->raw_value()->IsFalse()) {
     return AsmType::Int();
   }
 
   uint32_t value;
   if (!literal->value()->ToUint32(&value)) {
     int32_t value;
     if (!literal->value()->ToInt32(&value)) {
       FAIL(literal, "Integer literal is out of range.");
     }
-    // *VIOLATION* Not really a violation, but rather a different in the
+    // *VIOLATION* Not really a violation, but rather a difference in
     // validation. The spec handles -NumericLiteral in ValidateUnaryExpression,
     // but V8's AST represents the negative literals as Literals.
     return AsmType::Signed();
   }
 
   if (value <= LargestFixNum) {
     return AsmType::FixNum();
   }
 
   return AsmType::Unsigned();
@@ skipping 1099 matching lines @@
     return true;
   }
 
   *error_message = typer.error_message();
   return false;
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8