[wasm] Verify expressions do not cross control boundaries in WASM.

src/wasm/ast-decoder.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/signature.h"
 
 #include "src/bit-vector.h"
 #include "src/flags.h"
 #include "src/handles.h"
 #include "src/zone-containers.h"
@@ skipping 1139 matching lines @@
       if (val.type != kAstEnd) {
         error(pc_, val.pc, "%s[%d] expected type %s, found %s of type %s",
               SafeOpcodeNameAt(pc_), index, WasmOpcodes::TypeName(expected),
               SafeOpcodeNameAt(val.pc), WasmOpcodes::TypeName(val.type));
       }
     }
     return val;
   }
 
   Value Pop() {
-    if (stack_.empty()) {
+    size_t limit = control_.empty() ? 0 : control_.back().stack_depth;

[ahaas, 2016/05/09 09:55:43]

Could you add a comment at the declaration of control_ which describes what
control_ is?

[titzer, 2016/05/09 09:57:20]

Done.

+    if (stack_.size() <= limit) {
       Value val = {pc_, nullptr, kAstStmt};
       error(pc_, pc_, "%s found empty stack", SafeOpcodeNameAt(pc_));
       return val;
     }
     Value val = stack_.back();
     stack_.pop_back();
     return val;
   }
 
   Value PopUpTo(int stack_depth) {
@@ skipping 476 matching lines @@
 BitVector* AnalyzeLoopAssignmentForTesting(Zone* zone, size_t num_locals,
                                            const byte* start, const byte* end) {
   FunctionBody body = {nullptr, nullptr, nullptr, start, end};
   SR_WasmDecoder decoder(zone, nullptr, body);
   return decoder.AnalyzeLoopAssignmentForTesting(start, num_locals);
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8