[wasm] Introduce <bot> type for unreachable br_table again

This CL implements the spec change done in
WebAssembly/reference-types#116.

[email protected]

Bug: v8:10994
Change-Id: Ic2b4e0a52af225b5640447fe051a9c36e6d41be2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534818
Commit-Queue: Andreas Haas <[email protected]>
Reviewed-by: Manos Koukoutos <[email protected]>
Cr-Commit-Position: refs/heads/master@{#71260}

Author: gahaas

src/wasm/function-body-decoder-impl.h

@@ -3407,17 +3407,8 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     for (int i = 0; i < br_arity; ++i) {
       if (this->enabled_.has_reftypes()) {
         // The expected type is the biggest common sub type of all targets.
-        ValueType type = (*result_types)[i];
         (*result_types)[i] =
             CommonSubtype((*result_types)[i], (*merge)[i].type, this->module_);
-        if (!VALIDATE((*result_types)[i] != kWasmBottom)) {
-          this->DecodeError(pos,
-                            "inconsistent type in br_table target %u (previous "
-                            "was %s, this one is %s)",
-                            index, type.name().c_str(),
-                            (*merge)[i].type.name().c_str());
-          return false;
-        }
       } else {
         // All target must have the same signature.
         if (!VALIDATE((*result_types)[i] == (*merge)[i].type)) {

test/mjsunit/regress/wasm/regress-1046472.js

@@ -29,6 +29,5 @@ kExprEnd,   // @21
   assertThrows(
       () => {builder.toModule()}, WebAssembly.CompileError,
       'WebAssembly.Module(): Compiling function #0:\"main\" failed: ' +
-      'inconsistent type in br_table target 1 (previous was i32, ' +
-      'this one is f32) @+60');
+      'type error in merge[0] (expected <bot>, got i32) @+57');
 })();

test/wasm-spec-tests/wasm-spec-tests.status

@@ -9,7 +9,6 @@
   'binary': [FAIL],
   'proposals/bulk-memory-operations/binary': [FAIL],
   # TODO(v8:10994): Failing spec test after update.
-  'proposals/reference-types/br_table': [FAIL],
   'proposals/simd/binary': [FAIL],
   'proposals/simd/data': [FAIL],
   'proposals/js-types/data': [FAIL],
@@ -36,6 +35,7 @@
   'proposals/tail-call/imports': [FAIL],
   'proposals/tail-call/linking': [FAIL],
   'proposals/tail-call/type': [FAIL],
+  'proposals/tail-call/unreached-invalid': [FAIL],
 
   # This test requires the reftypes flag to be disabled.
   'proposals/bulk-memory-operations/imports': [FAIL],