[wasm] Validate the index of set local in AnalyzeLoopAssignment

test/unittests/wasm/loop-assignment-analysis-unittest.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "test/unittests/test-utils.h"
 
 #include "src/v8.h"
 
 #include "test/cctest/wasm/test-signatures.h"
 
@@ skipping 31 matching lines @@
   byte code[] = {kExprLoop, 0};
   for (int i = 0; i < 5; i++) {
     BitVector* assigned = Analyze(code, code + arraysize(code));
     for (int j = 0; j < assigned->length(); j++) {
       CHECK_EQ(false, assigned->Contains(j));
     }
     num_locals++;
   }
 }
 
+TEST_F(WasmLoopAssignmentAnalyzerTest, regress_642867) {
+  static const byte code[] = {
+      WASM_LOOP(WASM_ZERO, kExprSetLocal, 0xfa, 0xff, 0xff, 0xff,
+                0x0f)};  // local index LEB128 0xfffffffa
+  BitVector* assigned = Analyze(code, code + arraysize(code));
+  CHECK_NULL(assigned);
+}
+
 TEST_F(WasmLoopAssignmentAnalyzerTest, One) {
   num_locals = 5;
   for (int i = 0; i < 5; i++) {
     byte code[] = {WASM_LOOP(WASM_SET_ZERO(i))};
     BitVector* assigned = Analyze(code, code + arraysize(code));
     for (int j = 0; j < assigned->length(); j++) {
       CHECK_EQ(j == i, assigned->Contains(j));
     }
   }
 }
@@ skipping 121 matching lines @@
   byte code[] = {kExprLoop, kExprF32Neg, kExprBrTable, 0x0e, 'h', 'e',
                  'l',       'l',         'o',          ',',  ' ', 'w',
                  'o',       'r',         'l',          'd',  '!'};
   BitVector* assigned = Analyze(code, code + arraysize(code));
   CHECK_NULL(assigned);
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8