[liftoff] Check unsupported loop multi-return

R=clemensb@chromium.org

Change-Id: I061ca50c08cfa2bc60e74e4387e3e2933659202b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1864655Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64333}

src/wasm/baseline/liftoff-compiler.cc

@@ -524,6 +524,10 @@ class LiftoffCompiler {
   void Block(FullDecoder* decoder, Control* block) {}
 
   void Loop(FullDecoder* decoder, Control* loop) {
+    if (loop->start_merge.arity > 0 || loop->end_merge.arity > 1) {
+      return unsupported(decoder, kMultiValue, "multi-value loop");
+    }
+
     // Before entering a loop, spill all locals to the stack, in order to free
     // the cache registers, and to avoid unnecessarily reloading stack values
     // into registers at branches.