[wasm] Indirect calls without function table cause validation errors.

src/wasm/ast-decoder.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/signature.h"
 
 #include "src/bit-vector.h"
 #include "src/flags.h"
 #include "src/handles.h"
 #include "src/zone/zone-containers.h"
@@ skipping 1118 matching lines @@
             if (Validate(pc_, operand)) {
               TFNode** buffer = PopArgs(operand.sig);
               TFNode** rets = nullptr;
               BUILD(CallDirect, operand.index, buffer, &rets, position());
               PushReturns(operand.sig, rets);
             }
             len = 1 + operand.length;
             break;
           }
           case kExprCallIndirect: {
+            uint32_t table_index = 0;
             CallIndirectOperand operand(this, pc_);
-            if (Validate(pc_, operand)) {
+            if (Validate(pc_, operand) && module_->IsValidTable(table_index)) {

[titzer, 2016/11/07 09:24:11]

Why not just move this logic into the Validate method?

[ahaas, 2016/11/07 09:35:56]

Done. I misunderstood the Validate method.

               Value index = Pop(0, kAstI32);
               TFNode** buffer = PopArgs(operand.sig);
               if (buffer) buffer[0] = index.node;
               TFNode** rets = nullptr;
               BUILD(CallIndirect, operand.index, buffer, &rets, position());
               PushReturns(operand.sig, rets);
+            } else {
+              error("function table has to exist to execute call_indirect");
             }
             len = 1 + operand.length;
             break;
           }
           case kSimdPrefix: {
             CHECK_PROTOTYPE_OPCODE(wasm_simd_prototype);
             len++;
             byte simd_index = checked_read_u8(pc_, 1, "simd index");
             opcode = static_cast<WasmOpcode>(opcode << 8 | simd_index);
             TRACE("  @%-4d #%02x #%02x:%-20s|", startrel(pc_), kSimdPrefix,
@@ skipping 873 matching lines @@
 BitVector* AnalyzeLoopAssignmentForTesting(Zone* zone, size_t num_locals,
                                            const byte* start, const byte* end) {
   FunctionBody body = {nullptr, nullptr, nullptr, start, end};
   WasmFullDecoder decoder(zone, nullptr, body);
   return decoder.AnalyzeLoopAssignmentForTesting(start, num_locals);
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8