[Liftoff] Fix cache state initialization

Ensure that the type is always stored correctly.

R=titzer@chromium.org

Bug: v8:6600, chromium:791810
Change-Id: Id3a3c20b14f8730b9550c548dec49ac47121e691
Reviewed-on: https://chromium-review.googlesource.com/811188Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49924}

src/wasm/baseline/liftoff-assembler.cc

@@ -214,7 +214,6 @@ void LiftoffAssembler::CacheState::InitMerge(const CacheState& source,
         reg = unused_register(rc);
       } else {
         // Make this a stack slot.
-        DCHECK(src.is_stack());
         dst = VarState(src.type());
         continue;
       }
@@ -232,17 +231,16 @@ void LiftoffAssembler::CacheState::InitMerge(const CacheState& source,
       if (is_used(src.reg())) {
         // Make this a stack slot.
         dst = VarState(src.type());
-        continue;
-      }
+      } else {
         dst = VarState(src.type(), src.reg());
         inc_used(src.reg());
+      }
     } else if (src.is_const()) {
       dst = src;
     } else {
-      // Keep this a stack slot (which is the initial value).
       DCHECK(src.is_stack());
-      DCHECK(dst.is_stack());
-      continue;
+      // Make this a stack slot.
+      dst = VarState(src.type());
     }
   }
   last_spilled_gp_reg = source.last_spilled_gp_reg;

test/mjsunit/regress/wasm/regress-791810.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction('test', kSig_i_i)
+    .addBody([
+      kExprGetLocal, 0x00,    // get_local 0
+      kExprBlock, kWasmStmt,  // block
+      kExprBr, 0x00,          // br depth=0
+      kExprEnd,               // end
+      kExprBlock, kWasmStmt,  // block
+      kExprBr, 0x00,          // br depth=0
+      kExprEnd,               // end
+      kExprBr, 0x00,          // br depth=0
+    ])
+    .exportFunc();
+builder.instantiate();