[wasm] Verify expressions do not cross control boundaries in WASM.

src/wasm/ast-decoder.cc

Index: src/wasm/ast-decoder.cc
diff --git a/src/wasm/ast-decoder.cc b/src/wasm/ast-decoder.cc
index 1432e152b084ceb9d1c6b1017dac97fadb9ec57f..f3dab7625665750f2774cd9a5d02503c23382241 100644
--- a/src/wasm/ast-decoder.cc
+++ b/src/wasm/ast-decoder.cc
@@ -1157,7 +1157,8 @@ class SR_WasmDecoder : public WasmDecoder {
   }
 
   Value Pop() {
-    if (stack_.empty()) {
+    size_t limit = control_.empty() ? 0 : control_.back().stack_depth;

[ahaas, 2016/05/09 09:55:43]

Could you add a comment at the declaration of control_ which describes what
control_ is?

[titzer, 2016/05/09 09:57:20]

Done.

+    if (stack_.size() <= limit) {
       Value val = {pc_, nullptr, kAstStmt};
       error(pc_, pc_, "%s found empty stack", SafeOpcodeNameAt(pc_));
       return val;