[wasm][mv] Fix unreachable type checking order

R=ahaas@chromium.org

Change-Id: I0405abbd8fc047653758ac41d185bf0f44e33d09
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1859617
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64309}

src/wasm/function-body-decoder-impl.h

@@ -2992,9 +2992,9 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     // For conditional branches, stack value '0' is the condition of the branch,
     // and the result values start at index '1'.
     int index_offset = conditional_branch ? 1 : 0;
-    for (int i = 0; i < arity; ++i) Pop(index_offset + i, merge[i].type);
+    for (int i = arity - 1; i >= 0; --i) Pop(index_offset + i, merge[i].type);
     // Push values of the correct type back on the stack.
-    for (int i = arity - 1; i >= 0; --i) Push(merge[i].type);
+    for (int i = 0; i < arity; ++i) Push(merge[i].type);
     return this->ok();
   }
 

test/mjsunit/wasm/multi-value.js

@@ -66,6 +66,49 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
   assertEquals(instance.exports.main(1, 4), 5);
 })();
 
+(function MultiBlockUnreachableTest() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let sig_il_v = builder.addType(makeSig([], [kWasmI32, kWasmI64]));
+
+  builder.addFunction("main", kSig_i_v)
+    .addBody([
+      kExprBlock, sig_il_v,
+      kExprI32Const, 1,
+      kExprI64Const, 1,
+      kExprBr, 0,
+      kExprI32Const, 1,
+      kExprI64Const, 1,
+      kExprEnd,
+      kExprDrop])
+    .exportAs("main");
+
+  let module = new WebAssembly.Module(builder.toBuffer());
+  let instance = new WebAssembly.Instance(module);
+  assertEquals(instance.exports.main(1, 2), 1);
+})();
+
+(function MultiBlockUnreachableTypeErrorTest() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let sig_il_v = builder.addType(makeSig([], [kWasmI32, kWasmI64]));
+
+  builder.addFunction("main", kSig_i_v)
+    .addBody([
+      kExprBlock, sig_il_v,
+      kExprI32Const, 1,
+      kExprI64Const, 1,
+      kExprBr, 0,
+      kExprI64Const, 1,
+      kExprI32Const, 1,
+      // Wrong order: expect i32, i64.
+      kExprEnd,
+      kExprDrop])
+    .exportAs("main");
+
+  assertThrows(() => new WebAssembly.Module(builder.toBuffer()),
+      WebAssembly.CompileError, /expected type i64, found i32.const/);
+})();
 
 (function MultiLoopResultTest() {
   print("MultiLoopResultTest");