[wasm] Validate the index of set local in AnalyzeLoopAssignment

test/unittests/wasm/loop-assignment-analysis-unittest.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "test/unittests/test-utils.h"
 
 #include "src/v8.h"
 
 #include "test/cctest/wasm/test-signatures.h"
 
@@ skipping 169 matching lines @@
 }
 
 TEST_F(WasmLoopAssignmentAnalyzerTest, Malformed) {
   byte code[] = {kExprLoop, kExprF32Neg, kExprBrTable, 0x0e, 'h', 'e',
                  'l',       'l',         'o',          ',',  ' ', 'w',
                  'o',       'r',         'l',          'd',  '!'};
   BitVector* assigned = Analyze(code, code + arraysize(code));
   CHECK_NULL(assigned);
 }
 
+TEST_F(WasmLoopAssignmentAnalyzerTest, regress_642867) {
+  static const byte code[] = {
+      WASM_LOOP(WASM_ZERO, kExprSetLocal, 0xfa, 0xff, 0xff, 0xff,
+                0x0f)};  // local index LEB128 0xfffffffa
+  // Just make sure that the analysis does not crash.
+  Analyze(code, code + arraysize(code));
+}
+
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8