[wasm] Gate SIMD load/store opcodes with the --wasm-simd-prototype flag.

BUG=chromium:702460

R=mtrofin@chromium.org, bbudge@chromium.org

Review-Url: https://codereview.chromium.org/2794693002
Cr-Commit-Position: refs/heads/master@{#44319}

src/wasm/function-body-decoder.cc

@@ -1158,6 +1158,7 @@ class WasmFullDecoder : public WasmDecoder {
             len = DecodeLoadMem(kWasmF64, MachineType::Float64());
             break;
           case kExprS128LoadMem:
+            CHECK_PROTOTYPE_OPCODE(wasm_simd_prototype);
             len = DecodeLoadMem(kWasmS128, MachineType::Simd128());
             break;
           case kExprI32StoreMem8:
@@ -1188,6 +1189,7 @@ class WasmFullDecoder : public WasmDecoder {
             len = DecodeStoreMem(kWasmF64, MachineType::Float64());
             break;
           case kExprS128StoreMem:
+            CHECK_PROTOTYPE_OPCODE(wasm_simd_prototype);
             len = DecodeStoreMem(kWasmS128, MachineType::Simd128());
             break;
           case kExprGrowMemory: {

test/mjsunit/regress/wasm/regression-702460.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function() {
+"use asm";
+  var builder = new WasmModuleBuilder();
+  builder.addFunction("regression_702460", kSig_i_v)
+    .addBody([
+        kExprI32Const, 0x52,
+        kExprI32Const, 0x41,
+        kExprI32Const, 0x3c,
+        kExprI32Const, 0xdc, 0x01,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprSetLocal, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprGrowMemory, 0x00,
+        kExprS128LoadMem, 0x00, 0x40,
+        kExprUnreachable,
+        kExprGrowMemory, 0x00
+        ]).exportFunc();
+  assertThrows(() => builder.instantiate());
+})();

test/mjsunit/wasm/wasm-constants.js

@@ -315,6 +315,7 @@ let kExprI32ReinterpretF32 = 0xbc;
 let kExprI64ReinterpretF64 = 0xbd;
 let kExprF32ReinterpretI32 = 0xbe;
 let kExprF64ReinterpretI64 = 0xbf;
+let kExprS128LoadMem = 0xc0;
 
 let kTrapUnreachable          = 0;
 let kTrapMemOutOfBounds       = 1;