[wasm] Stop the BranchTableIterator if there is an error in the decoder.

src/wasm/ast-decoder.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/signature.h"
 
 #include "src/bit-vector.h"
 #include "src/flags.h"
 #include "src/handles.h"
 #include "src/zone/zone-containers.h"
@@ skipping 847 matching lines @@
               Value key = Pop(0, kAstI32);
               if (failed()) break;
 
               SsaEnv* break_env = ssa_env_;
               if (operand.table_count > 0) {
                 // Build branches to the various blocks based on the table.
                 TFNode* sw = BUILD(Switch, operand.table_count + 1, key.node);
 
                 SsaEnv* copy = Steal(break_env);
                 ssa_env_ = copy;
-                while (iterator.has_next()) {
+                while (ok() && iterator.has_next()) {
                   uint32_t i = iterator.cur_index();
                   const byte* pos = iterator.pc();
                   uint32_t target = iterator.next();
                   if (target >= control_.size()) {
                     error(pos, "improper branch in br_table");
                     break;
                   }
                   ssa_env_ = Split(copy);
                   ssa_env_->control = (i == operand.table_count)
                                           ? BUILD(IfDefault, sw)
                                           : BUILD(IfValue, i, sw);
                   BreakTo(target);
                 }
+                if (failed()) break;
               } else {
                 // Only a default target. Do the equivalent of br.
                 const byte* pos = iterator.pc();
                 uint32_t target = iterator.next();
                 if (target >= control_.size()) {
                   error(pos, "improper branch in br_table");
                   break;
                 }
                 BreakTo(target);
               }
@@ skipping 1057 matching lines @@
 BitVector* AnalyzeLoopAssignmentForTesting(Zone* zone, size_t num_locals,
                                            const byte* start, const byte* end) {
   FunctionBody body = {nullptr, nullptr, nullptr, start, end};
   WasmFullDecoder decoder(zone, nullptr, body);
   return decoder.AnalyzeLoopAssignmentForTesting(start, num_locals);
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8