[wasm] Fix interpreter Ref in unreachable code

For "else" and "catch" statements, the Ref to the end label should only
be added if the current block is unreachable, not the parent block.

In the added regression test, the "true" block ends in an unreachable
state with a stack height less than the target height of the end label.
This is valid due to the semantics of unreachable code, but we should
not add the Ref in this case because its stack height is invalid.

R=clemensb@chromium.org

Fixed: chromium:1092130
Change-Id: Iebaf5e7d6516278ccd3c8268ac331069e109d882
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2412181
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69934}

test/cctest/wasm/test-run-wasm-interpreter.cc

@@ -486,6 +486,18 @@ TEST(Regress1111015) {
   BUILD(r, WASM_BLOCK_I(WASM_RETURN_CALL_FUNCTION0(f.function_index()),
                         kExprDrop));
   BUILD(f, WASM_I32V(0));
+}
+
+TEST(Regress1092130) {
+  WasmRunner<uint32_t> r(TestExecutionTier::kInterpreter);
+  TestSignatures sigs;
+  byte sig_v_i = r.builder().AddSignature(sigs.v_i());
+  BUILD(r, WASM_I32V(0),
+        WASM_IF_ELSE_I(
+            WASM_I32V(0),
+            WASM_SEQ(WASM_UNREACHABLE, WASM_BLOCK_X(sig_v_i, WASM_NOP)),
+            WASM_I32V(0)),
+        WASM_DROP);
   r.Call();
 }
 

test/common/wasm/wasm-interpreter.cc

@@ -847,7 +847,7 @@ class SideTable : public ZoneObject {
           Control* c = &control_stack.back();
           copy_unreachable();
           TRACE("control @%u: Else\n", i.pc_offset());
-          if (!control_parent().unreachable) {
+          if (!unreachable) {
             c->end_label->Ref(i.pc(), stack_height);
           }
           DCHECK_NOT_NULL(c->else_label);
@@ -883,7 +883,7 @@ class SideTable : public ZoneObject {
           exception_stack.pop_back();
           copy_unreachable();
           TRACE("control @%u: Catch\n", i.pc_offset());
-          if (!control_parent().unreachable) {
+          if (!unreachable) {
             c->end_label->Ref(i.pc(), stack_height);
           }
           DCHECK_NOT_NULL(c->else_label);

test/unittests/wasm/control-transfer-unittest.cc

@@ -203,7 +203,7 @@ TEST_F(ControlTransferTest, IfBrElse) {
       kExprElse,      // @6
       kExprEnd        // @7
   };
-  CheckTransfers(code, {{2, 5, 0, 0}, {4, 4, 0, 0}, {6, 2, 0, 0}});
+  CheckTransfers(code, {{2, 5, 0, 0}, {4, 4, 0, 0}});
 }
 
 TEST_F(ControlTransferTest, IfElseBr) {