[wasm] Abort decoding of BlockTypeImmediate after an error was detected

R=titzer@chromium.org

Bug: chromium:875556
Change-Id: I989dbaaec1eac3b7d0c761f25efec043cdeb9d71
Reviewed-on: https://chromium-review.googlesource.com/1180964Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55212}

src/wasm/function-body-decoder-impl.h

@@ -223,6 +223,7 @@ struct BlockTypeImmediate {
         decoder->error(pc + 1, "invalid block type");
         return;
       }
+      if (!VALIDATE(decoder->ok())) return;
       int32_t index =
           decoder->read_i32v<validate>(pc + 1, &length, "block arity");
       if (!VALIDATE(length > 0 && index >= 0)) {

test/mjsunit/regress/wasm/regress-875556.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// Flags: --expose-wasm --experimental-wasm-mv
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function() {
+  const builder = new WasmModuleBuilder();
+  // Generate function 1 (out of 2).
+  sig1 = makeSig([kWasmI32], []);
+  builder.addFunction("main", sig1).addBodyWithEnd([
+    // signature: v_i
+    // body:
+    kExprBlock,
+  ]);
+  assertThrows(function() { builder.instantiate(); }, WebAssembly.CompileError);
+})();