[wasm] Verify boundaries of data segments when decoding modules.

src/wasm/wasm-js.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/api.h"
 #include "src/api-natives.h"
 #include "src/assert-scope.h"
 #include "src/ast/ast.h"
 #include "src/ast/scopes.h"
 #include "src/factory.h"
@@ skipping 19 matching lines @@
 namespace {
 struct RawBuffer {
   const byte* start;
   const byte* end;
   size_t size() { return static_cast<size_t>(end - start); }
 };
 
 
 RawBuffer GetRawBufferArgument(
     ErrorThrower& thrower, const v8::FunctionCallbackInfo<v8::Value>& args) {
+  // TODO(titzer): allow typed array views.
   if (args.Length() < 1 || !args[0]->IsArrayBuffer()) {
     thrower.Error("Argument 0 must be an array buffer");
     return {nullptr, nullptr};
   }
   Local<ArrayBuffer> buffer = Local<ArrayBuffer>::Cast(args[0]);
   ArrayBuffer::Contents contents = buffer->GetContents();
 
-  // TODO(titzer): allow offsets into buffers, views, etc.
-
   const byte* start = reinterpret_cast<const byte*>(contents.Data());
   const byte* end = start + contents.ByteLength();
 
   if (start == nullptr) {
     thrower.Error("ArrayBuffer argument is empty");
   }
   return {start, end};
 }
 
 
@@ skipping 265 matching lines @@
   if (!context->get(Context::WASM_FUNCTION_MAP_INDEX)->IsMap()) {
     Handle<Map> wasm_function_map = isolate->factory()->NewMap(
         JS_FUNCTION_TYPE, JSFunction::kSize + kPointerSize);
     wasm_function_map->set_is_callable();
     context->set_wasm_function_map(*wasm_function_map);
   }
 }
 
 }  // namespace internal
 }  // namespace v8