Enforce asm restrictions on switch more precisely.

src/typing-asm.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "src/typing-asm.h"
+
+#include <limits>
+
 #include "src/v8.h"
 
-#include "src/typing-asm.h"
-
 #include "src/ast/ast.h"
 #include "src/ast/scopes.h"
 #include "src/codegen.h"
 #include "src/type-cache.h"
 
 namespace v8 {
 namespace internal {
 
 #define FAIL(node, msg)                                        \
   do {                                                         \
@@ skipping 360 matching lines @@
 }
 
 
 void AsmTyper::VisitSwitchStatement(SwitchStatement* stmt) {
   if (!in_function_) {
     FAIL(stmt, "switch statement inside module body");
   }
   RECURSE(VisitWithExpectation(stmt->tag(), cache_.kAsmSigned,
                                "switch expression non-integer"));
   ZoneList<CaseClause*>* clauses = stmt->cases();
+  ZoneSet<int32_t> cases(zone());
   for (int i = 0; i < clauses->length(); ++i) {
     CaseClause* clause = clauses->at(i);
-    if (!clause->is_default()) {
+    if (clause->is_default()) {
+      if (i != clauses->length() - 1) {
+        FAIL(clause, "default case out of order");
+      }
+    } else {
       Expression* label = clause->label();
       RECURSE(VisitWithExpectation(label, cache_.kAsmSigned,
                                    "case label non-integer"));
       if (!label->IsLiteral()) FAIL(label, "non-literal case label");
       Handle<Object> value = label->AsLiteral()->value();
       int32_t value32;
       if (!value->ToInt32(&value32)) FAIL(label, "illegal case label value");
+      if (cases.find(value32) != cases.end()) {
+        FAIL(label, "duplicate case value");
+      }
+      cases.insert(value32);
     }
     // TODO(bradnelson): Detect duplicates.
     ZoneList<Statement*>* stmts = clause->statements();
     RECURSE(VisitStatements(stmts));
   }
+  if (cases.size() > 0) {
+    int64_t min_case = *cases.begin();
+    int64_t max_case = *cases.rbegin();
+    if (max_case - min_case > std::numeric_limits<int32_t>::max()) {
+      FAIL(stmt, "case range too large");
+    }
+  }
 }
 
 
 void AsmTyper::VisitCaseClause(CaseClause* clause) { UNREACHABLE(); }
 
 
 void AsmTyper::VisitDoWhileStatement(DoWhileStatement* stmt) {
   if (!in_function_) {
     FAIL(stmt, "do statement inside module body");
   }
@@ skipping 1051 matching lines @@
 
 
 void AsmTyper::VisitRewritableAssignmentExpression(
     RewritableAssignmentExpression* expr) {
   RECURSE(Visit(expr->expression()));
 }
 
 
 }  // namespace internal
 }  // namespace v8