Fix bitcode parser to check ValueAsMetaData::get calls.

[kschimpf]

Summary

Using fuzzing, detected an assertion failure on calls to
ValueAsMetaData::get. This method asserts that the argument
must be non-null. Fixes callers in bitcode reader to check
and generate appropriate error if null.

[filcab]

Hi Karl,

Can you test both METADATA_OLD_NODE and METADATA_VALUE?

Thank you!

lib/Bitcode/Reader/BitcodeReader.cpp

case bitc::METADATA_OLD_NODE: {
       SmallVector<Metadata *, 8> Elts;
       for (unsigned i = 0; i != Size; i += 2) {
         Type *Ty = getTypeByID(Record[i]);
         if (!Ty)
           return error("Invalid record");
         if (Ty->isMetadataTy())
           Elts.push_back(MDValueList.getValueFwdRef(Record[i+1]));
         else if (!Ty->isVoidTy()) {
-          auto *MD =
-              ValueAsMetadata::get(ValueList.getValueFwdRef(Record[i + 1], Ty));
+          Value *Val = ValueList.getValueFwdRef(Record[i + 1], Ty);
+          if (Val == nullptr)
+            return error("Invalid record");
+          auto *MD = ValueAsMetadata::get(Val);
           assert(isa<ConstantAsMetadata>(MD) &&
                  "Expected non-function-local metadata");
           Elts.push_back(MD);
         } else
           Elts.push_back(nullptr);
       }
       MDValueList.assignValue(MDNode::get(Context, Elts), NextMDValueNo++);
       break;
     }
     case bitc::METADATA_VALUE: {
       if (Record.size() != 2)
         return error("Invalid record");
 
       Type *Ty = getTypeByID(Record[0]);
       if (Ty->isMetadataTy() || Ty->isVoidTy())
         return error("Invalid record");
 
-      MDValueList.assignValue(
-          ValueAsMetadata::get(ValueList.getValueFwdRef(Record[1], Ty)),
-          NextMDValueNo++);
+      Value *Val = ValueList.getValueFwdRef(Record[1], Ty);
+      if (Val == nullptr)
+        return error("Invalid record");
+      MDValueList.assignValue(ValueAsMetadata::get(Val), NextMDValueNo++);
       break;
     }
     case bitc::METADATA_DISTINCT_NODE:
       IsDistinct = true;
       // fallthrough...
     case bitc::METADATA_NODE: {
       SmallVector<Metadata *, 8> Elts;
       Elts.reserve(Record.size());

test/Bitcode/invalid.test

 RUN:   FileCheck --check-prefix=VECTOR-LENGTH %s
 
 VECTOR-LENGTH: Invalid vector length
 
 RUN: not llvm-dis -disable-output %p/Inputs/invalid-alias-type-mismatch.bc 2>&1 | \
 RUN:   FileCheck --check-prefix=ALIAS-TYPE-MISMATCH %s
 
 ALIAS-TYPE-MISMATCH: Alias and aliasee types don't match
+
+RUN: not llvm-dis -disable-output %p/Inputs/invalid-meta-old-node-ref.bc 2>&1 | \
+RUN:   FileCheck --check-prefix=BAD-META-OLD-NODE-REF %s
+
+BAD-META-OLD-NODE-REF: Invalid record