[wasm] Validate the index of set local in AnalyzeLoopAssignment

src/wasm/ast-decoder.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/signature.h"
 
 #include "src/bit-vector.h"
 #include "src/flags.h"
 #include "src/handles.h"
 #include "src/zone-containers.h"
@@ skipping 1832 matching lines @@
         case kExprIf:
         case kExprBlock:
         case kExprTryCatch:
         case kExprTryCatchFinally:
         case kExprTryFinally:
           depth++;
           DCHECK_EQ(1, OpcodeLength(pc));
           break;
         case kExprSetLocal: {
           LocalIndexOperand operand(this, pc);
-          if (assigned->length() > 0 &&
-              static_cast<int>(operand.index) < assigned->length()) {
-            // Unverified code might have an out-of-bounds index.
-            assigned->Add(operand.index);
+          if (Validate(pc_, operand)) {

[titzer, 2016/09/01 13:12:44]

I think if you just remove the static_cast to int, this will work. That was the
intention of the check, anyway.

[ahaas, 2016/09/01 13:53:15]

Done. I think that calling Validate() would have actually been an error because
Validate() causes an error state.

+            if (assigned->length() > 0 &&
+                static_cast<int>(operand.index) < assigned->length()) {
+              // Unverified code might have an out-of-bounds index.
+              assigned->Add(operand.index);
+            }
           }
           length = 1 + operand.length;
           break;
         }
         case kExprEnd:
           depth--;
           break;
         default:
           length = OpcodeLength(pc);
           break;
@@ skipping 197 matching lines @@
 BitVector* AnalyzeLoopAssignmentForTesting(Zone* zone, size_t num_locals,
                                            const byte* start, const byte* end) {
   FunctionBody body = {nullptr, nullptr, nullptr, start, end};
   WasmFullDecoder decoder(zone, nullptr, body);
   return decoder.AnalyzeLoopAssignmentForTesting(start, num_locals);
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8