Backed out changeset b89a4862242c (bug 1624490) for causing CompileError asertion failures CLOSED TREE
authorCiure Andrei <aciure@mozilla.com>
Wed, 25 Mar 2020 19:03:28 +0200
changeset 520403 cdf202c2682eccdb9781145451cb707ec157db9d
parent 520402 5366f10ff74911beb52cbaaf96b118981ce02b11
child 520404 570f25f87e0a1d49e413b2ab92710ffd58c5fdbb
push id37249
push userdvarga@mozilla.com
push dateWed, 25 Mar 2020 21:39:06 +0000
treeherdermozilla-central@b3c3f7d0f044 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1624490
milestone76.0a1
backs outb89a4862242cf93166205e15ccdff8e9c04de9b5
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Backed out changeset b89a4862242c (bug 1624490) for causing CompileError asertion failures CLOSED TREE
js/src/wasm/WasmValidate.cpp
--- a/js/src/wasm/WasmValidate.cpp
+++ b/js/src/wasm/WasmValidate.cpp
@@ -2510,16 +2510,20 @@ static bool DecodeElemSection(Decoder& d
         }
 
         RefType initType = RefType::any();
         switch (op.b0) {
           case uint16_t(Op::RefFunc):
             initType = RefType::func();
             break;
           case uint16_t(Op::RefNull):
+            if (kind == ElemSegmentKind::Declared) {
+              return d.fail(
+                  "declared element segments cannot contain ref.null");
+            }
             initType = RefType::null();
             needIndex = false;
             break;
           default:
             return d.fail("failed to read initializer operation");
         }
         if (!env->isRefSubtypeOf(ValType(initType), ValType(elemType))) {
           return d.fail("initializer type must be subtype of element type");