[wasm] Fix typing of loop labels in br_table

R=ahaas@chromium.org
BUG=v8:6204

Review-Url: https://codereview.chromium.org/2799753003
Cr-Commit-Position: refs/heads/master@{#44435}

src/wasm/function-body-decoder.cc

@@ -988,22 +988,24 @@ class WasmFullDecoder : public WasmDecoder {
                   BreakTo(target);
 
                   // Check that label types match up.
+                  static MergeValues loop_dummy = {0, {nullptr}};
                   Control* c = &control_[control_.size() - target - 1];
+                  MergeValues* current = c->is_loop() ? &loop_dummy : &c->merge;
                   if (i == 0) {
-                    merge = &c->merge;
-                  } else if (merge->arity != c->merge.arity) {
+                    merge = current;
+                  } else if (merge->arity != current->arity) {
                     errorf(pos,
                            "inconsistent arity in br_table target %d"
                            " (previous was %u, this one %u)",
-                           i, merge->arity, c->merge.arity);
+                           i, merge->arity, current->arity);
                   } else if (control_.back().unreachable) {
                     for (uint32_t j = 0; ok() && j < merge->arity; ++j) {
-                      if ((*merge)[j].type != c->merge[j].type) {
+                      if ((*merge)[j].type != (*current)[j].type) {
                         errorf(pos,
                                "type error in br_table target %d operand %d"
                                " (previous expected %s, this one %s)",
                                i, j, WasmOpcodes::TypeName((*merge)[j].type),
-                               WasmOpcodes::TypeName(c->merge[j].type));
+                               WasmOpcodes::TypeName((*current)[j].type));
                       }
                     }
                   }

test/cctest/wasm/test-run-wasm.cc

@@ -1018,6 +1018,20 @@ WASM_EXEC_TEST(BrTable4_fallthru) {
   CHECK_EQ(108, r.Call(4, 100));
 }
 
+WASM_EXEC_TEST(BrTable_loop_target) {
+  byte code[] = {
+      WASM_LOOP_I(
+          WASM_BLOCK(
+              WASM_BR_TABLE(WASM_GET_LOCAL(0), 2,
+                  BR_TARGET(0), BR_TARGET(1), BR_TARGET(1))),
+          WASM_ONE)};
+
+  WasmRunner<int32_t, int32_t> r(execution_mode);
+  r.Build(code, code + arraysize(code));
+
+  CHECK_EQ(1, r.Call(0));
+}
+
 WASM_EXEC_TEST(F32ReinterpretI32) {
   WasmRunner<int32_t> r(execution_mode);
   int32_t* memory = r.module().AddMemoryElems<int32_t>(8);