[turbofan] Use uint32 to store the number of control outputs instead of uint16.

src/wasm/ast-decoder.h

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_WASM_AST_DECODER_H_
 #define V8_WASM_AST_DECODER_H_
 
 #include "src/base/compiler-specific.h"
 #include "src/globals.h"
 #include "src/signature.h"
@@ skipping 202 matching lines @@
 
 struct BranchTableOperand {
   uint32_t table_count;
   const byte* start;
   const byte* table;
   inline BranchTableOperand(Decoder* decoder, const byte* pc) {
     DCHECK_EQ(kExprBrTable, decoder->checked_read_u8(pc, 0, "opcode"));
     start = pc + 1;
     unsigned len1 = 0;
     table_count = decoder->checked_read_u32v(pc, 1, &len1, "table count");
-    if (table_count > (UINT_MAX / sizeof(uint32_t)) - 1 ||
+    // The limit of {table_count} is UINT16_MAX because that is the maximum
+    // value of the switch parameter in TurboFan.
+    if (table_count >

[titzer, 2016/10/18 12:34:07]

Can we instead fix the TurboFan operator? IIRC such switches may show up in the
wild.

+            static_cast<uint32_t>(std::numeric_limits<uint16_t>::max()) ||
         len1 > UINT_MAX - (table_count + 1) * sizeof(uint32_t)) {
       decoder->error(pc, "branch table size overflow");
     }
     table = pc + 1 + len1;
   }
   inline uint32_t read_entry(Decoder* decoder, unsigned i) {
     DCHECK(i <= table_count);
     return table ? decoder->read_u32(table + i * sizeof(uint32_t)) : 0;
   }
 };
@@ skipping 184 matching lines @@
   }
 
   bool has_next() { return pc_ < end_; }
 };
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_WASM_AST_DECODER_H_