g# Enter a description of the change.

[wasm] Fix signature canonicalization for error case.

The decoder should not attempt to insert null signatures into the SignatureMap.

R=ahaas@chromium.org

Bug: chromium:775366
Change-Id: I0fbc0547dbf00fd25d37271a03b6756481a4c6a1
Reviewed-on: https://chromium-review.googlesource.com/730752Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48793}

src/wasm/module-decoder.cc

@@ -423,7 +423,8 @@ class ModuleDecoderImpl : public Decoder {
             static_cast<int>(pc_ - start_));
       FunctionSig* s = consume_sig(module_->signature_zone.get());
       module_->signatures.push_back(s);
-      module_->signature_ids.push_back(module_->signature_map.FindOrInsert(s));
+      uint32_t id = s ? module_->signature_map.FindOrInsert(s) : 0;
+      module_->signature_ids.push_back(id);
     }
     module_->signature_map.Freeze();
   }

test/mjsunit/regress/wasm/regress-775366.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+
+(function BadTypeSection() {
+  var data = bytes(
+    kWasmH0,
+    kWasmH1,
+    kWasmH2,
+    kWasmH3,
+
+    kWasmV0,
+    kWasmV1,
+    kWasmV2,
+    kWasmV3,
+
+    kTypeSectionCode,
+    5,
+    2,
+    0x60,
+    0,
+    0,
+    13
+  );
+
+  assertFalse(WebAssembly.validate(data));
+})();