[turbofan] Use uint32 to store the number of control outputs instead of uint16.

src/wasm/ast-decoder.h

Index: src/wasm/ast-decoder.h
diff --git a/src/wasm/ast-decoder.h b/src/wasm/ast-decoder.h
index feafa2618fa52990afea9178a54a6a780ac3d877..2f7c0e2e21e5b00781989e02d212c3f22e738a2c 100644
--- a/src/wasm/ast-decoder.h
+++ b/src/wasm/ast-decoder.h
@@ -220,7 +220,10 @@ struct BranchTableOperand {
     start = pc + 1;
     unsigned len1 = 0;
     table_count = decoder->checked_read_u32v(pc, 1, &len1, "table count");
-    if (table_count > (UINT_MAX / sizeof(uint32_t)) - 1 ||
+    // The limit of {table_count} is UINT16_MAX because that is the maximum
+    // value of the switch parameter in TurboFan.
+    if (table_count >

[titzer, 2016/10/18 12:34:07]

Can we instead fix the TurboFan operator? IIRC such switches may show up in the
wild.

+            static_cast<uint32_t>(std::numeric_limits<uint16_t>::max()) ||
         len1 > UINT_MAX - (table_count + 1) * sizeof(uint32_t)) {
       decoder->error(pc, "branch table size overflow");
     }