[wasm] Unreachability fix for br_table.

R=rossberg@chromium.org
BUG=chromium:682659

Review-Url: https://codereview.chromium.org/2646093003
Cr-Commit-Position: refs/heads/master@{#42564}

src/wasm/function-body-decoder.cc

@@ -684,6 +684,10 @@ class WasmFullDecoder : public WasmDecoder {
             CHECK_PROTOTYPE_OPCODE(wasm_eh_prototype);
             Value value = Pop(0, kWasmI32);
             BUILD(Throw, value.node);
+            // TODO(titzer): Throw should end control, but currently we build a
+            // (reachable) runtime call instead of connecting it directly to
+            // end.
+            //            EndControl();
             break;
           }
           case kExprTry: {
@@ -953,6 +957,7 @@ class WasmFullDecoder : public WasmDecoder {
               ssa_env_ = break_env;
             }
             len = 1 + iterator.length();
+            EndControl();
             break;
           }
           case kExprReturn: {

test/unittests/wasm/function-body-decoder-unittest.cc

@@ -2133,6 +2133,12 @@ TEST_F(FunctionBodyDecoderTest, BrTable_invalid_br2) {
   }
 }
 
+TEST_F(FunctionBodyDecoderTest, BrUnreachable) {
+  static byte code[] = {WASM_GET_LOCAL(0), kExprBrTable,  0,
+                        BR_TARGET(0),      kExprSetLocal, 0};
+  EXPECT_VERIFIES_C(v_i, code);
+}
+
 TEST_F(FunctionBodyDecoderTest, Brv1) {
   EXPECT_VERIFIES(i_i, WASM_BLOCK_I(WASM_BRV(0, WASM_ZERO)));
   EXPECT_VERIFIES(i_i, WASM_BLOCK_I(WASM_LOOP(WASM_BRV(2, WASM_ZERO))));
@@ -2225,6 +2231,12 @@ TEST_F(FunctionBodyDecoderTest, Throw) {
   EXPECT_FAILURE(l_l, WASM_GET_LOCAL(0), kExprThrow, WASM_I64V(0));
 }
 
+TEST_F(FunctionBodyDecoderTest, ThrowUnreachable) {
+  // TODO(titzer): unreachable code after throw should validate.
+  // FLAG_wasm_eh_prototype = true;
+  // EXPECT_VERIFIES(v_i, WASM_GET_LOCAL(0), kExprThrow, kExprSetLocal, 0);
+}
+
 #define WASM_TRY_OP kExprTry, kLocalVoid
 
 #define WASM_CATCH(local) kExprCatch, static_cast<byte>(local)