• Clemens Hammacher's avatar
    [wasm] Check for illegal br table count · 74519c43
    Clemens Hammacher authored
    The underlying issue is that TF Nodes cannot handle input counts
    outside the integer range. On an illegal br_table instruction, we
    generated a switch node with a control output count >kMaxInt.
    Operator::ControlOutputCount turned this into a negative integer later,
    leading to a failing DCHECK.
    Since such large numbers cannot occur in any valid wasm function anyway,
    we just add an additional check to the br table count. There is already
    a TODO in the code to change Operator::ControlOutputCount to size_t.
    
    R=ahaas@chromium.org
    BUG=chromium:722445
    
    Change-Id: I1975072226e073dee6c8da3b9fa9a050a4695917
    Reviewed-on: https://chromium-review.googlesource.com/505496Reviewed-by: 's avatarAndreas Haas <ahaas@chromium.org>
    Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
    Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#45365}
    74519c43
regression-722445.js 581 Bytes