[wasm] Element section with segments but without a table is invalid.

R=titzer@chromium.org

Change-Id: I637cbafc99caf1ada1d92d41f7796cf5551bc532
Reviewed-on: https://chromium-review.googlesource.com/588895
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47667}

src/wasm/module-decoder.cc

@@ -666,6 +666,10 @@ class ModuleDecoder : public Decoder {
   void DecodeElementSection() {
     uint32_t element_count =
         consume_count("element count", FLAG_wasm_max_table_size);
+
+    if (element_count > 0 && module_->function_tables.size() == 0) {
+      error(pc_, "The element section requires a table");
+    }
     for (uint32_t i = 0; ok() && i < element_count; ++i) {
       const byte* pos = pc();
       uint32_t table_index = consume_u32v("table index");

test/unittests/wasm/module-decoder-unittest.cc

@@ -744,6 +744,52 @@ TEST_F(WasmModuleVerifyTest, OneIndirectFunction) {
   }
 }
 
+TEST_F(WasmModuleVerifyTest, ElementSectionWithInternalTable) {
+  static const byte data[] = {
+      // table ---------------------------------------------------------------
+      SECTION(Table, 4), ENTRY_COUNT(1), kWasmAnyFunctionTypeForm, 0, 1,
+      // elements ------------------------------------------------------------
+      SECTION(Element, 1),
+      0  // entry count
+  };
+
+  EXPECT_VERIFIES(data);
+}
+
+TEST_F(WasmModuleVerifyTest, ElementSectionWithImportedTable) {
+  static const byte data[] = {
+      // imports -------------------------------------------------------------
+      SECTION(Import, 9), ENTRY_COUNT(1),
+      NAME_LENGTH(1),            // --
+      'm',                       // module name
+      NAME_LENGTH(1),            // --
+      't',                       // table name
+      kExternalTable,            // import kind
+      kWasmAnyFunctionTypeForm,  // elem_type
+      0,                         // no maximum field
+      1,                         // initial size
+      // elements ------------------------------------------------------------
+      SECTION(Element, 1),
+      0  // entry count
+  };
+
+  EXPECT_VERIFIES(data);
+}
+
+TEST_F(WasmModuleVerifyTest, ElementSectionWithoutTable) {
+  // Test that an element section without a table causes a validation error.
+  static const byte data[] = {
+      // elements ------------------------------------------------------------
+      SECTION(Element, 4),
+      1,  // entry count
+      0,  // table index
+      0,  // offset
+      0   // number of elements
+  };
+
+  EXPECT_FAILURE(data);
+}
+
 TEST_F(WasmModuleVerifyTest, Regression_735887) {
   // Test with an invalid function index in the element section.
   static const byte data[] = {