Xtensa: Reachable assert in `decodeImm8_sh8Operand()`

[Rot127]

We discovered a reachable assert in the Xtensa disassembler in decodeImm8_sh8Operand().

The immediate given to decodeImm8_sh8Operand has already been shifted. Checking if it is an 8bit value fails therefore.

decodeImm8_sh8Operand gets called from XtensaGenDisassemblerTables.inc like this:

...
    if (!Check(S, DecodeARRegisterClass(MI, tmp, Address, Decoder))) { return MCDisassembler::Fail; }
    tmp = fieldFromInstruction(insn, 16, 8) << 8;
    if (!Check(S, decodeImm8_sh8Operand(MI, tmp, Address, Decoder))) { return MCDisassembler::Fail; }
    return S;
...

so the assert will fail:

static DecodeStatus decodeImm8Operand(MCInst &Inst, uint64_t Imm,
                                      int64_t Address, const void *Decoder) {
  assert(isUInt<8>(Imm) && "Invalid immediate");

Fix (in C): capstone-engine/llvm-capstone#62

cc @andreisfr

[bugadani]

I can't tell when the fix will be merged upstream, but this has been corrected in our fork already.