[wasm] Fix misaligned accesses and endianness issues in decoders.

src/wasm/ast-decoder.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/base/platform/elapsed-timer.h"
 #include "src/signature.h"
 
 #include "src/bit-vector.h"
 #include "src/flags.h"
 #include "src/handles.h"
@@ skipping 94 matching lines @@
   WasmDecoder() : Decoder(nullptr, nullptr), function_env_(nullptr) {}
 
  protected:
   FunctionEnv* function_env_;
 
   void Reset(FunctionEnv* function_env, const byte* start, const byte* end) {
     Decoder::Reset(start, end);
     function_env_ = function_env;
   }
 
-  // Load an operand at [pc + 1].
-  template <typename V>
-  V Operand(const byte* pc) {
-    if ((limit_ - pc) < static_cast<int>(1 + sizeof(V))) {
-      const char* msg = "Expected operand following opcode";
-      switch (sizeof(V)) {
-        case 1:
-          msg = "Expected 1-byte operand following opcode";
-          break;
-        case 2:
-          msg = "Expected 2-byte operand following opcode";
-          break;
-        case 4:
-          msg = "Expected 4-byte operand following opcode";
-          break;
-        default:
-          break;
-      }
+  byte ByteOperand(const byte* pc, const char* msg = "missing 1-byte operand") {
+    if ((pc + sizeof(byte)) >= limit_) {
       error(pc, msg);
-      return -1;
+      return 0;
     }
-    return *reinterpret_cast<const V*>(pc + 1);
+    return pc[1];
+  }
+
+  uint32_t Uint32Operand(const byte* pc) {
+    if ((pc + sizeof(uint32_t)) >= limit_) {
+      error(pc, "missing 4-byte operand");
+      return 0;
+    }
+    return read_u32(pc + 1);
+  }
+
+  uint64_t Uint64Operand(const byte* pc) {
+    if ((pc + sizeof(uint64_t)) >= limit_) {
+      error(pc, "missing 8-byte operand");
+      return 0;
+    }
+    return read_u64(pc + 1);
   }
 
   LocalType LocalOperand(const byte* pc, uint32_t* index, int* length) {
     *index = UnsignedLEB128Operand(pc, length);
     if (function_env_->IsValidLocal(*index)) {
       return function_env_->GetLocalType(*index);
     }
     error(pc, "invalid local variable index");
     return kAstStmt;
   }
@@ skipping 31 matching lines @@
     uint32_t result = 0;
     ReadUnsignedLEB128ErrorCode error_code =
         ReadUnsignedLEB128Operand(pc + 1, limit_, length, &result);
     if (error_code == kInvalidLEB128) error(pc, "invalid LEB128 varint");
     if (error_code == kMissingLEB128) error(pc, "expected LEB128 varint");
     (*length)++;
     return result;
   }
 
   void MemoryAccessOperand(const byte* pc, int* length, uint32_t* offset) {
-    byte bitfield = Operand<uint8_t>(pc);
+    byte bitfield = ByteOperand(pc, "missing memory access operand");
     if (MemoryAccess::OffsetField::decode(bitfield)) {
       *offset = UnsignedLEB128Operand(pc + 1, length);
       (*length)++;  // to account for the memory access byte
     } else {
       *offset = 0;
       *length = 2;
     }
   }
 };
 
@@ skipping 225 matching lines @@
           return;
         }
         continue;  // back to decoding loop.
       }
 
       switch (opcode) {
         case kExprNop:
           Leaf(kAstStmt);
           break;
         case kExprBlock: {
-          int length = Operand<uint8_t>(pc_);
+          int length = ByteOperand(pc_);
           if (length < 1) {
             Leaf(kAstStmt);
           } else {
             Shift(kAstEnd, length);
             // The break environment is the outer environment.
             SsaEnv* break_env = ssa_env_;
             PushBlock(break_env);
             SetEnv("block:start", Steal(break_env));
           }
           len = 2;
           break;
         }
         case kExprLoop: {
-          int length = Operand<uint8_t>(pc_);
+          int length = ByteOperand(pc_);
           if (length < 1) {
             Leaf(kAstStmt);
           } else {
             Shift(kAstEnd, length);
             // The break environment is the outer environment.
             SsaEnv* break_env = ssa_env_;
             PushBlock(break_env);
             SsaEnv* cont_env = Steal(break_env);
             // The continue environment is the inner environment.
             PrepareForLoop(cont_env);
             SetEnv("loop:start", Split(cont_env));
             if (ssa_env_->go()) ssa_env_->state = SsaEnv::kReached;
             PushBlock(cont_env);
             blocks_.back().stack_depth = -1;  // no production for inner block.
           }
           len = 2;
           break;
         }
         case kExprIf:
           Shift(kAstStmt, 2);
           break;
         case kExprIfElse:
           Shift(kAstEnd, 3);  // Result type is typeof(x) in {c ? x : y}.
           break;
         case kExprSelect:
           Shift(kAstStmt, 3);  // Result type is typeof(x) in {c ? x : y}.
           break;
         case kExprBr: {
-          uint32_t depth = Operand<uint8_t>(pc_);
+          uint32_t depth = ByteOperand(pc_);
           Shift(kAstEnd, 1);
           if (depth >= blocks_.size()) {
             error("improperly nested branch");
           }
           len = 2;
           break;
         }
         case kExprBrIf: {
-          uint32_t depth = Operand<uint8_t>(pc_);
+          uint32_t depth = ByteOperand(pc_);
           Shift(kAstStmt, 2);
           if (depth >= blocks_.size()) {
             error("improperly nested conditional branch");
           }
           len = 2;
           break;
         }
         case kExprTableSwitch: {
           if (!checkAvailable(5)) {
             error("expected #tableswitch <cases> <table>, fell off end");
             break;
           }
-          uint16_t case_count = *reinterpret_cast<const uint16_t*>(pc_ + 1);
-          uint16_t table_count = *reinterpret_cast<const uint16_t*>(pc_ + 3);
+          uint16_t case_count = read_u16(pc_ + 1);
+          uint16_t table_count = read_u16(pc_ + 3);
           len = 5 + table_count * 2;
 
           if (table_count == 0) {
             error("tableswitch with 0 entries");
             break;
           }
 
           if (!checkAvailable(len)) {
             error("expected #tableswitch <cases> <table>, fell off end");
             break;
           }
 
           Shift(kAstEnd, 1 + case_count);
 
           // Verify table.
           for (int i = 0; i < table_count; i++) {
-            uint16_t target =
-                *reinterpret_cast<const uint16_t*>(pc_ + 5 + i * 2);
+            uint16_t target = read_u16(pc_ + 5 + i * 2);
             if (target >= 0x8000) {
               size_t depth = target - 0x8000;
               if (depth > blocks_.size()) {
                 error(pc_ + 5 + i * 2, "improper branch in tableswitch");
               }
             } else {
               if (target >= case_count) {
                 error(pc_ + 5 + i * 2, "invalid case target in tableswitch");
               }
             }
@@ skipping 11 matching lines @@
           }
           break;
         }
         case kExprUnreachable: {
           BUILD0(Unreachable);
           ssa_env_->Kill(SsaEnv::kControlEnd);
           Leaf(kAstEnd, nullptr);
           break;
         }
         case kExprI8Const: {
-          int32_t value = Operand<int8_t>(pc_);
+          int32_t value = bit_cast<int8_t>(ByteOperand(pc_));
           Leaf(kAstI32, BUILD(Int32Constant, value));
           len = 2;
           break;
         }
         case kExprI32Const: {
-          int32_t value = Operand<int32_t>(pc_);
+          uint32_t value = Uint32Operand(pc_);
           Leaf(kAstI32, BUILD(Int32Constant, value));
           len = 5;
           break;
         }
         case kExprI64Const: {
-          int64_t value = Operand<int64_t>(pc_);
+          uint64_t value = Uint64Operand(pc_);
           Leaf(kAstI64, BUILD(Int64Constant, value));
           len = 9;
           break;
         }
         case kExprF32Const: {
-          float value = Operand<float>(pc_);
+          float value = bit_cast<float>(Uint32Operand(pc_));
           Leaf(kAstF32, BUILD(Float32Constant, value));
           len = 5;
           break;
         }
         case kExprF64Const: {
-          double value = Operand<double>(pc_);
+          double value = bit_cast<double>(Uint64Operand(pc_));
           Leaf(kAstF64, BUILD(Float64Constant, value));
           len = 9;
           break;
         }
         case kExprGetLocal: {
           uint32_t index;
           LocalType type = LocalOperand(pc_, &index, &len);
           TFNode* val =
               build() && type != kAstStmt ? ssa_env_->locals[index] : nullptr;
           Leaf(type, val);
@@ skipping 285 matching lines @@
             TFNode* vals[2] = {p->tree->children[1]->node,
                                p->tree->children[2]->node};
             TFNode* phi = builder_->Phi(p->tree->type, 2, vals, merge);
             p->tree->node = phi;
             ssa_env_->control = merge;
           }
         }
         break;
       }
       case kExprBr: {
-        uint32_t depth = Operand<uint8_t>(p->pc());
+        uint32_t depth = ByteOperand(p->pc());
         if (depth >= blocks_.size()) {
           error("improperly nested branch");
           break;
         }
         Block* block = &blocks_[blocks_.size() - depth - 1];
         ReduceBreakToExprBlock(p, block);
         break;
       }
       case kExprBrIf: {
         if (p->index == 1) {
           TypeCheckLast(p, kAstI32);
         } else if (p->done()) {
-          uint32_t depth = Operand<uint8_t>(p->pc());
+          uint32_t depth = ByteOperand(p->pc());
           if (depth >= blocks_.size()) {
             error("improperly nested branch");
             break;
           }
           Block* block = &blocks_[blocks_.size() - depth - 1];
           SsaEnv* fenv = ssa_env_;
           SsaEnv* tenv = Split(fenv);
           BUILD(Branch, p->tree->children[0]->node, &tenv->control,
                 &fenv->control);
           ssa_env_ = tenv;
           ReduceBreakToExprBlock(p, block);
           ssa_env_ = fenv;
         }
         break;
       }
       case kExprTableSwitch: {
         if (p->index == 1) {
           // Switch key finished.
           TypeCheckLast(p, kAstI32);
 
-          uint16_t table_count =
-              *reinterpret_cast<const uint16_t*>(p->pc() + 3);
+          uint16_t table_count = read_u16(p->pc() + 3);
 
           // Build the switch only if it has more than just a default target.
           bool build_switch = table_count > 1;
           TFNode* sw = nullptr;
           if (build_switch) sw = BUILD(Switch, table_count, p->last()->node);
 
           // Allocate environments for each case.
-          uint16_t case_count = *reinterpret_cast<const uint16_t*>(p->pc() + 1);
+          uint16_t case_count = read_u16(p->pc() + 1);
           SsaEnv** case_envs = zone_->NewArray<SsaEnv*>(case_count);
           for (int i = 0; i < case_count; i++) case_envs[i] = UnreachableEnv();
 
           ifs_.push_back({nullptr, nullptr, case_envs});
           SsaEnv* break_env = ssa_env_;
           PushBlock(break_env);
           SsaEnv* copy = Steal(break_env);
           ssa_env_ = copy;
 
           // Build the environments for each case based on the table.
-          const uint16_t* table =
-              reinterpret_cast<const uint16_t*>(p->pc() + 5);
           for (int i = 0; i < table_count; i++) {
-            uint16_t target = table[i];
+            uint16_t target = read_u16(p->pc() + 5 + i * 2);
             SsaEnv* env = copy;
             if (build_switch) {
               env = Split(env);
               env->control = (i == table_count - 1) ? BUILD(IfDefault, sw)
                                                     : BUILD(IfValue, i, sw);
             }
             if (target >= 0x8000) {
               // Targets an outer block.
               int depth = target - 0x8000;
               SsaEnv* tenv = blocks_[blocks_.size() - depth - 1].ssa_env;
@@ skipping 737 matching lines @@
 
 BitVector* AnalyzeLoopAssignmentForTesting(Zone* zone, FunctionEnv* env,
                                            const byte* start, const byte* end) {
   LoopAssignmentAnalyzer analyzer(zone, env);
   return analyzer.Analyze(start, end);
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8