The throw and try_table validators looked up the tag referenced by the
instruction, then indexed m_context.types with the tag's type index
without checking it was in range. validate(TagIndex) only validates the
tag index itself, and the tag section is validated after the code
section, so a module whose tag carries an out-of-range type index
reached the unchecked m_context.types[...] access and tripped a Vector
bounds assertion during validation.
Any WebAssembly.compile() of such a module aborts the WebContent
process.
Validate the tag's type index before using it, the same check
validate(TagType) already performs.
be4173af81