[wasm] Fix br_table in the wasm interpreter to use varuint32.

src/wasm/wasm-interpreter.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/wasm/wasm-interpreter.h"
 
 #include "src/utils.h"
 #include "src/wasm/ast-decoder.h"
 #include "src/wasm/decoder.h"
 #include "src/wasm/wasm-external-refs.h"
@@ skipping 1313 matching lines @@
             len = DoBreak(code, pc, operand.depth);
             TRACE("  br_if => @%zu\n", pc + len);
           } else {
             TRACE("  false => fallthrough\n");
             len = 1 + operand.length;
           }
           break;
         }
         case kExprBrTable: {
           BranchTableOperand operand(&decoder, code->at(pc));
+          BranchTableIterator iterator(&decoder, operand);
           uint32_t key = Pop().to<uint32_t>();
+          uint32_t depth = 0;
           if (key >= operand.table_count) key = operand.table_count;
-          len = key + DoBreak(code, pc + key, operand.table[key]);
+          for (uint32_t i = 0; i <= key; i++) {
+            DCHECK(iterator.has_next());
+            depth = iterator.next();
+          }
+          len = key + DoBreak(code, pc + key, static_cast<size_t>(depth));
           TRACE("  br[%u] => @%zu\n", key, pc + key + len);
           break;
         }
         case kExprReturn: {
           size_t arity = code->function->sig->return_count();
           if (!DoReturn(&code, &pc, &limit, arity)) return;
           decoder.Reset(code->start, code->end);
           continue;
         }
         case kExprUnreachable: {
@@ skipping 532 matching lines @@
 
 ControlTransferMap WasmInterpreter::ComputeControlTransfersForTesting(
     Zone* zone, const byte* start, const byte* end) {
   ControlTransfers targets(zone, nullptr, nullptr, start, end);
   return targets.map_;
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8