Bug 1463378: Guard against sentinel values when creating AstRef; r=luke

--HG--
extra : rebase_source : 0320838569a167f56d914b830c66d2c1ee8e33d0
extra : histedit_source : ae4bb293d83b2e2e69889a02d23160fec3352f4f

js/src/jit-test/tests/wasm/text.js

@@ -20,6 +20,9 @@ assertErrorMessage(() => wasmEvalText('(module (type $a (func)) (func (call_indi
 assertErrorMessage(() => wasmEvalText('(module (func (br $a)))'), SyntaxError, /branch target label '\$a' not found/);
 assertErrorMessage(() => wasmEvalText('(module (func (block $a ) (br $a)))'), SyntaxError, /branch target label '\$a' not found/);
 
+assertErrorMessage(() => wasmEvalText(`(module (func (call ${0xffffffff})))`), SyntaxError, parsingError);
+assertErrorMessage(() => wasmEvalText(`(module (export "func" ${0xffffffff}))`), SyntaxError, parsingError);
+
 wasmEvalText('(module (func (param $a i32)))');
 wasmEvalText('(module (func (param i32)))');
 wasmEvalText('(module (func (param i32 i32 f32 f64 i32)))');

js/src/wasm/WasmTextToBinary.cpp

@@ -705,8 +705,11 @@ class WasmTokenStream
             *ref = AstRef(token.name());
             break;
           case WasmToken::Index:
-            *ref = AstRef(token.index());
-            break;
+            if (token.index() != AstNoIndex) {
+                *ref = AstRef(token.index());
+                break;
+            }
+            MOZ_FALLTHROUGH;
           default:
             generateError(token, error);
             return false;
@@ -3656,9 +3659,15 @@ ParseExport(WasmParseContext& c)
     WasmToken exportee = c.ts.get();
     switch (exportee.kind()) {
       case WasmToken::Index:
-        return new(c.lifo) AstExport(name.text(), DefinitionKind::Function, AstRef(exportee.index()));
+        if (exportee.index() == AstNoIndex) {
+            c.ts.generateError(exportee, c.error);
+            return nullptr;
+        }
+        return new(c.lifo) AstExport(name.text(), DefinitionKind::Function,
+                                     AstRef(exportee.index()));
       case WasmToken::Name:
-        return new(c.lifo) AstExport(name.text(), DefinitionKind::Function, AstRef(exportee.name()));
+        return new(c.lifo) AstExport(name.text(), DefinitionKind::Function,
+                                     AstRef(exportee.name()));
       case WasmToken::Table: {
         AstRef ref;
         if (!c.ts.getIfRef(&ref))