Validation: Fix br_table instruction type checking

Author: kateinoigakukun

Sources/WasmKit/Translator.swift

@@ -987,8 +987,10 @@ struct InstructionTranslator<Context: TranslatorContext>: InstructionVisitor {
             case .local(let localIndex):
                 // Re-push local variables to the stack
                 _ = try valueStack.pushLocal(localIndex, locals: &locals)
-            case .vreg, nil:
+            case .vreg:
                 _ = valueStack.push(type)
+            case nil:
+                _ = valueStack.push(.unknown)
             case .const(let index, let type):
                 valueStack.pushConst(index, type: type)
             }
@@ -1408,6 +1410,13 @@ struct InstructionTranslator<Context: TranslatorContext>: InstructionVisitor {
         //     +---> [0x0b] ...
         for (entryIndex, labelIndex) in allLabelIndices.enumerated() {
             let frame = try controlStack.branchTarget(relativeDepth: labelIndex)
+
+            // Check copyTypes consistency
+            guard frame.copyTypes.count == defaultFrame.copyTypes.count else {
+                throw ValidationError("Expected the same copy types for all branches in `br_table` but got \(frame.copyTypes) and \(defaultFrame.copyTypes)")
+            }
+            try popPushValues(frame.copyTypes)
+
             do {
                 let relativeOffset = iseqBuilder.insertingPC.offsetFromHead - brTableAt.offsetFromHead
                 tableBuffer[entryIndex] = Instruction.BrTableOperand.Entry(
@@ -1427,6 +1436,10 @@ struct InstructionTranslator<Context: TranslatorContext>: InstructionVisitor {
                 }
             }
         }
+        // Pop branch copy values for type checking
+        for type in defaultFrame.copyTypes.reversed() {
+            _ = try popOperand(type)
+        }
         try markUnreachable()
     }
 

Tests/WasmKitTests/SpectestTests.swift

@@ -22,7 +22,6 @@ final class SpectestTests: XCTestCase {
             path: Self.testPaths,
             include: [],
             exclude: [
-                "/br_table.wast",
                 "table_get.wast",
                 "table_grow.wast",
                 "table_size.wast",