Reject first-class arrays on initializers in strict-ES2 mode.
The fuzzer discovered that it could create vardecls for arrays
which copied from other arrays without triggering an error; later,
we had a transformation which would turn those vardecls into
assignment-statements, which did trigger an error, because we
had correctly guarded against this non-ES2 compatible assignment.
In strict ES2 mode, vardecl initializers are now rejected entirely
for "is-or-contains-array" types.
Bug: oss-fuzz:59873
Change-Id: If206412ba9c1adc76bf4ac9795c28809188df3e9
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/712759
Auto-Submit: John Stiles <johnstiles@google.com>
Commit-Queue: Brian Osman <brianosman@google.com>
Reviewed-by: Brian Osman <brianosman@google.com>
Commit-Queue: John Stiles <johnstiles@google.com>
2 files changed