[wasm] Fix typing of loop labels in br_table

src/wasm/function-body-decoder.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/signature.h"
 
 #include "src/base/platform/elapsed-timer.h"
 #include "src/bit-vector.h"
 #include "src/flags.h"
 #include "src/handles.h"
@@ skipping 970 matching lines @@
                     error(pos, "improper branch in br_table");
                     break;
                   }
                   ssa_env_ = Split(copy);
                   ssa_env_->control = (i == operand.table_count)
                                           ? BUILD(IfDefault, sw)
                                           : BUILD(IfValue, i, sw);
                   BreakTo(target);
 
                   // Check that label types match up.
+                  static MergeValues loop_dummy = {0, {nullptr}};
                   Control* c = &control_[control_.size() - target - 1];
+                  MergeValues* current = c->is_loop() ? &loop_dummy : &c->merge;
                   if (i == 0) {
-                    merge = &c->merge;
-                  } else if (merge->arity != c->merge.arity) {
+                    merge = current;
+                  } else if (merge->arity != current->arity) {
                     errorf(pos,
                            "inconsistent arity in br_table target %d"
                            " (previous was %u, this one %u)",
-                           i, merge->arity, c->merge.arity);
+                           i, merge->arity, current->arity);
                   } else if (control_.back().unreachable) {
                     for (uint32_t j = 0; ok() && j < merge->arity; ++j) {
-                      if ((*merge)[j].type != c->merge[j].type) {
+                      if ((*merge)[j].type != (*current)[j].type) {
                         errorf(pos,
                                "type error in br_table target %d operand %d"
                                " (previous expected %s, this one %s)",
                                i, j, WasmOpcodes::TypeName((*merge)[j].type),
-                               WasmOpcodes::TypeName(c->merge[j].type));
+                               WasmOpcodes::TypeName((*current)[j].type));
                       }
                     }
                   }
                 }
                 if (failed()) break;
               } else {
                 // Only a default target. Do the equivalent of br.
                 const byte* pos = iterator.pc();
                 uint32_t target = iterator.next();
                 if (target >= control_.size()) {
@@ skipping 1155 matching lines @@
 BitVector* AnalyzeLoopAssignmentForTesting(Zone* zone, size_t num_locals,
                                            const byte* start, const byte* end) {
   Decoder decoder(start, end);
   return WasmDecoder::AnalyzeLoopAssignment(&decoder, start,
                                             static_cast<int>(num_locals), zone);
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8