[wasm] Validate the index of set local in AnalyzeLoopAssignment

BUG=chromium:642867
R=titzer@chromium.org
TEST=loop-assignment-analysis-unittest.cc:regress_642867

Review-Url: https://codereview.chromium.org/2290233008
Cr-Commit-Position: refs/heads/master@{#39089}

src/wasm/ast-decoder.cc

@@ -1851,7 +1851,7 @@ class WasmFullDecoder : public WasmDecoder {
         case kExprSetLocal: {
           LocalIndexOperand operand(this, pc);
           if (assigned->length() > 0 &&
-              static_cast<int>(operand.index) < assigned->length()) {
+              operand.index < static_cast<uint32_t>(assigned->length())) {
             // Unverified code might have an out-of-bounds index.
             assigned->Add(operand.index);
           }

test/unittests/wasm/loop-assignment-analysis-unittest.cc

@@ -187,6 +187,14 @@ TEST_F(WasmLoopAssignmentAnalyzerTest, Malformed) {
   CHECK_NULL(assigned);
 }
 
+TEST_F(WasmLoopAssignmentAnalyzerTest, regress_642867) {
+  static const byte code[] = {
+      WASM_LOOP(WASM_ZERO, kExprSetLocal, 0xfa, 0xff, 0xff, 0xff,
+                0x0f)};  // local index LEB128 0xfffffffa
+  // Just make sure that the analysis does not crash.
+  Analyze(code, code + arraysize(code));
+}
+
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8