[WebAssembly] `AsmTypeCheck` support to br instr

[HerrCai0907]

Summary

This PR introduces the BrStack member to store the info about
loop, block, if and try. It can check whether br immediate number
out of range and whether type stack is mismatched in br instr.

[HerrCai0907]

remove unrelated file

[sbc100]

This comment was removed by sbc100.

[dschuff]

I like this idea. @aheejin is probably also a good reviewer for this.
Could delegate be checked similarly here too?

llvm/lib/Target/WebAssembly/AsmParser/WebAssemblyAsmTypeCheck.cpp

188

You're calling Operand.getImm() several times here, maybe pull it out into a variable?

[HerrCai0907]

add basis support for delegate

[HerrCai0907]

Could delegate be checked similarly here too?

Thinks for mentioning. I have fixed the behavior of end block to avoid incorrect BrStack.

Principle it is similarly expect the behavior in catch block. I think it can be done in another patch.

[tlively]

This looks pretty good!

llvm/lib/Target/WebAssembly/AsmParser/WebAssemblyAsmTypeCheck.cpp

218–219

Should this be outside the loop over the params? Otherwise we start with the same stack when checking each parameter, right?

llvm/test/MC/WebAssembly/type-checker-control-flow.s

132

It would be good to add a newline here.

llvm/test/MC/WebAssembly/type-checker-errors.s

524–525

This is actually valid. The rule for br is that if the label has type [t*], the stack before the br can be [t1* t*] for any t1*. The br implicitly drops everything in t1*.

See https://webassembly.github.io/spec/core/valid/instructions.html#xref-syntax-instructions-syntax-instr-control-mathsf-br-l

[HerrCai0907]

br will only check the stack top instead of whole stack

[HerrCai0907]

rebase

[aheejin]

This will have conflicts with D147852, so depending on which lands first, the other needs to resolve them. D147852 doesn't intend to add new functionalities (like br checking here) though; it just handles other block-ending instructions in the same way as end_block.

llvm/lib/Target/WebAssembly/AsmParser/WebAssemblyAsmTypeCheck.cpp

54–74

I think you can move this to the header, given that this doesn't have a body

63

I don't think we need to link the formal spec here; it's assumed the implementer and the reader of this file either knows or is able to look for it. We don't link it elsewhere in the file either.

160–161

180

Shouldn't we do -1? If not, the message can be something like

br: invalid depth 3 (max 3)

But -1 also has a problem, because when BrStack is empty it will print something like

br: invalid depth 0 (max -1)

So if we want to print (max N), it would be better to handle that case smoothly too.

185

195

196–229

197

TODO aheejin copy? do we use this later again?

199–200

204–205

Why is this and what does this code do?

236–241

I think you applied clang-format to the whole file. While we try to keep files clang-formatted, I think it'd be better not to mix this with other functionality changes. Can you revert this?

Tip: git clang-format main will clang-format only the changed lines, not the whole file. You can replace main with another branch or a commit if necessary.

279

Please revert unrelated clang-format changes

417–421

Please revert unrelated clang-format changes

433–435

Please revert unrelated clang-format changes

482–484

While is this here, while other block-like instructions (block, try, and loop) are checked separately (line 391-402) above?

llvm/lib/Target/WebAssembly/AsmParser/WebAssemblyAsmTypeCheck.h

41

llvm/test/MC/WebAssembly/basic-assembly.s

84–88

Why is this change necessary?

[aheejin]

llvm/lib/Target/WebAssembly/AsmParser/WebAssemblyAsmTypeCheck.cpp

197

Sorry, forgot to remove my own memo here, and Phabricator doesn't give a way to delete inline comments... Please ignore the message above. By the way, a question: this looks copying the stack intentionally not to modify BrStack.back().EnterStack, correct?

[aheejin]

llvm/lib/Target/WebAssembly/AsmParser/WebAssemblyAsmTypeCheck.cpp

448–452

I don't think we should restore try's EnterStack here? In a catch body, the only input params are the caught values, not the try's input types.

[HerrCai0907]

I will change those point and add comment also in code.

llvm/lib/Target/WebAssembly/AsmParser/WebAssemblyAsmTypeCheck.cpp

180

I also think it is -1, but when I use MDN's web runner for following code

(module
  (import "console" "log" (func $log (param i32)))

  (func $hhh
    i32.const 1
    call $log
    br 0
    i32.const 2
    call $log
  )

  (start 1) ;; run the first function automatically
)
``
It outputs `1`
I am not sure whether func body is a block which can also `br` to?

197

correct. here just checks whether the parameters of label are fulfilled.
e.g.

i32.const 1
block (i32, i32) -> (i32)
end_block

204–205

consider this case

i32.const 1
if  // store op stack
    return
    // here can do everything because of stack-polymorphic
else
    // here stack should be recovered as stored
end_if

236–241

Could it possible to submit a format patch before it?
Actually my arc always does format when I use arc diff.

llvm/test/MC/WebAssembly/basic-assembly.s

84–88

The old file is invalid but not be detected. (The op stack of true and false branch in if block are not balanced)
The reason I drop and push i32 is to avoid coupling in each checking block.
drop all operands in "switch" and re-introduce for "if"

[HerrCai0907]

llvm/lib/Target/WebAssembly/AsmParser/WebAssemblyAsmTypeCheck.cpp

448–452

The semantic of catch instructions in try [T1->T2] catch [T3] is [T2 -> T3].
If we don't restore the stack, we will get a incorrect stack after end_try.
For example

.tagtype TAG f32
i32.const 1
try i32
    f32.const 1.0
    throw TAG
    // here ok because unreachable
    drop
catch TAG
    i32.trunc_f32_s
end_try
// here type stack is [i32, i32] but without restore we will get error

[HerrCai0907]

llvm/lib/Target/WebAssembly/AsmParser/WebAssemblyAsmTypeCheck.cpp

448–452

block [T1] 
    xxxxx
end_block
try [T1->T2]
    instr1*
catch [T3]
    instr2*
end_try

after instr1*, the type stack should [T2] and without restore we push T3. After instr2, we will get [T2, T2] which is not incorrect

[HerrCai0907]

update without reverting format

[aheejin]

D147852 landed, so please rebase onto main and resolve conflicts.

llvm/lib/Target/WebAssembly/AsmParser/WebAssemblyAsmTypeCheck.cpp

63

Stray ;

180

Yes, the function body is also a block you can br to.

204–205

(The comments have moved so it's hard to track what code this was about, but it was about this code)

// In some cases (unreachable / br), `Stack` will be invalid and need to be
// recovered.
if (Unreachable)
  Stack = BrStack.pop_back_val().applySignature();
else
  BrStack.pop_back();

I think we already check this case? (The checker/parser had some bugs but some of them were fixed in D147852 and D147881, so please check them too) Can you give me an example that the current checker/parser misses on this case?

Also it's a little confusing that how much of the functionalities this CL adds overlaps with the existing ones. Currently we do some type checking in the parser too, which is hard to remove because the parser needs to check some basic things to parse. The CL header claims it is adding br checking, and I don't think we do br checking elsewhere, so I think it's a good thing to add, but this CL adds a lot more things. Can we possibly simplify this CL by adding only the missing checks?

236–241

Yeah a separate formatting CL is fine, but I wonder why your arc diff unconditionally formats it. There should be a way or an option not to do it. My arc diff asks me, doesn't unconditionally formats files, when submitting a CL, and also it only asks me if the lines I modified are not formatted and doesn't check other lines. What's your arc version?

437

D147852 moves this clause into else if (Name == "end_block" || Name == "end_loop" || Name == "end_if" || ..., so please resolve the conflict

482–484

Ping

[HerrCai0907]

simplify checker and re-submit in D148054

llvm/lib/Target/WebAssembly/AsmParser/WebAssemblyAsmTypeCheck.h

 ///
 /// It contains code to translate a parsed .s file into MCInsts.
 ///
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_LIB_TARGET_WEBASSEMBLY_ASMPARSER_TYPECHECK_H
 #define LLVM_LIB_TARGET_WEBASSEMBLY_ASMPARSER_TYPECHECK_H
 
+#include "llvm/ADT/SmallVector.h"
 #include "llvm/BinaryFormat/Wasm.h"
 #include "llvm/MC/MCInstrInfo.h"
 #include "llvm/MC/MCParser/MCAsmParser.h"
 #include "llvm/MC/MCParser/MCTargetAsmParser.h"
 #include "llvm/MC/MCSymbol.h"
+#include "llvm/Support/SMLoc.h"
 
 namespace llvm {
 
+class WebAssemblyAsmOperandFrame final {
+public:
+  using OperandStack = SmallVector<wasm::ValType, 8U>;
+  enum class FrameType {
+    Loop,
+    Block,
+    Try,
+    If,
+  };
+  WebAssemblyAsmOperandFrame(FrameType FrameType,
+                             const SmallVectorImpl<wasm::ValType> &Stack,
+                             const wasm::WasmSignature &Signature)
+      : Type(FrameType), EnterStack(Stack.begin(), Stack.end()),
+        Sig(Signature) {}
+  const OperandStack &getEnterStack() const { return EnterStack; }
+  OperandStack getResultType() const;
+  OperandStack applySignature() const;
+
+private:
+  const FrameType Type;
+  OperandStack EnterStack;
+  wasm::WasmSignature Sig;
+};
+
 class WebAssemblyAsmTypeCheck final {
   MCAsmParser &Parser;
   const MCInstrInfo &MII;
 
   SmallVector<wasm::ValType, 8> Stack;
   SmallVector<wasm::ValType, 16> LocalTypes;
   SmallVector<wasm::ValType, 4> ReturnTypes;
+  SmallVector<WebAssemblyAsmOperandFrame, 4> BrStack;
   wasm::WasmSignature LastSig;
   bool TypeErrorThisFunction = false;
   bool Unreachable = false;
   bool is64;
 
   void dumpTypeStack(Twine Msg);
   bool typeError(SMLoc ErrorLoc, const Twine &Msg);
   bool popType(SMLoc ErrorLoc, std::optional<wasm::ValType> EVT);
+  bool popType(SmallVectorImpl<wasm::ValType> &Stack, SMLoc ErrorLoc,
+               std::optional<wasm::ValType> EVT);
   bool popRefType(SMLoc ErrorLoc);
   bool getLocal(SMLoc ErrorLoc, const MCInst &Inst, wasm::ValType &Type);
-  bool checkEnd(SMLoc ErrorLoc, bool PopVals = false);
+  bool checkEnd(SMLoc ErrorLoc, bool RecoverEnter = false);
+  bool checkBr(SMLoc ErrorLoc, const MCInst &Inst);
+  bool checkBlockIn(WebAssemblyAsmOperandFrame::FrameType Type, SMLoc ErrorLoc,
+                    const MCInst &Inst);
   bool checkSig(SMLoc ErrorLoc, const wasm::WasmSignature &Sig);
   bool getSymRef(SMLoc ErrorLoc, const MCInst &Inst,
                  const MCSymbolRefExpr *&SymRef);
   bool getGlobal(SMLoc ErrorLoc, const MCInst &Inst, wasm::ValType &Type);
   bool getTable(SMLoc ErrorLoc, const MCInst &Inst, wasm::ValType &Type);
 
 public:
-  WebAssemblyAsmTypeCheck(MCAsmParser &Parser, const MCInstrInfo &MII, bool is64);
+  WebAssemblyAsmTypeCheck(MCAsmParser &Parser, const MCInstrInfo &MII,
+                          bool is64);
 
   void funcDecl(const wasm::WasmSignature &Sig);
   void localDecl(const SmallVectorImpl<wasm::ValType> &Locals);
   void setLastSig(const wasm::WasmSignature &Sig) { LastSig = Sig; }
   bool endOfFunction(SMLoc ErrorLoc);
   bool typeCheck(SMLoc ErrorLoc, const MCInst &Inst, OperandVector &Operands);
 
   void Clear() {
     Stack.clear();
     LocalTypes.clear();
     ReturnTypes.clear();
+    BrStack.clear();
     TypeErrorThisFunction = false;
     Unreachable = false;
   }
 };
 
 } // end namespace llvm
 
-#endif  // LLVM_LIB_TARGET_WEBASSEMBLY_ASMPARSER_TYPECHECK_H
+#endif // LLVM_LIB_TARGET_WEBASSEMBLY_ASMPARSER_TYPECHECK_H

llvm/lib/Target/WebAssembly/AsmParser/WebAssemblyAsmTypeCheck.cpp

 //===----------------------------------------------------------------------===//
 
 #include "AsmParser/WebAssemblyAsmTypeCheck.h"
 #include "MCTargetDesc/WebAssemblyMCTargetDesc.h"
 #include "MCTargetDesc/WebAssemblyMCTypeUtilities.h"
 #include "MCTargetDesc/WebAssemblyTargetStreamer.h"
 #include "TargetInfo/WebAssemblyTargetInfo.h"
 #include "WebAssembly.h"
+#include "llvm/ADT/SmallVector.h"
+#include "llvm/ADT/StringRef.h"
+#include "llvm/BinaryFormat/Wasm.h"
 #include "llvm/MC/MCContext.h"
 #include "llvm/MC/MCExpr.h"
 #include "llvm/MC/MCInst.h"
 #include "llvm/MC/MCInstrInfo.h"
 #include "llvm/MC/MCParser/MCParsedAsmOperand.h"
 #include "llvm/MC/MCParser/MCTargetAsmParser.h"
 #include "llvm/MC/MCSectionWasm.h"
 #include "llvm/MC/MCStreamer.h"
 #include "llvm/MC/MCSubtargetInfo.h"
 #include "llvm/MC/MCSymbol.h"
 #include "llvm/MC/MCSymbolWasm.h"
 #include "llvm/MC/TargetRegistry.h"
 #include "llvm/Support/Compiler.h"
+#include "llvm/Support/Debug.h"
 #include "llvm/Support/Endian.h"
+#include "llvm/Support/ErrorHandling.h"
 #include "llvm/Support/SourceMgr.h"
+#include <optional>
+#include <sstream>
+#include <string>
 
 using namespace llvm;
 
 #define DEBUG_TYPE "wasm-asm-parser"
 
 extern StringRef GetMnemonic(unsigned Opc);
 
 namespace llvm {
 
-WebAssemblyAsmTypeCheck::WebAssemblyAsmTypeCheck(MCAsmParser &Parser,
-                                                 const MCInstrInfo &MII, bool is64)
-    : Parser(Parser), MII(MII), is64(is64) {
+WebAssemblyAsmOperandFrame::OperandStack
+WebAssemblyAsmOperandFrame::getResultType() const {
+  switch (Type) {
+  case FrameType::Loop:
+    return OperandStack{Sig.Params.begin(), Sig.Params.end()};
+  case FrameType::Block:
+  case FrameType::Try:
+  case FrameType::If:
+    return OperandStack{Sig.Returns.begin(), Sig.Returns.end()};
+    ;
+  }
+  llvm_unreachable("invalid FrameType");
+}
+
+WebAssemblyAsmOperandFrame::OperandStack
+WebAssemblyAsmOperandFrame::applySignature() const {
+  OperandStack Stack{EnterStack};
+  Stack.pop_back_n(Sig.Params.size());
+  Stack.insert(Stack.end(), Sig.Returns.begin(), Sig.Returns.end());
+  return Stack;
 }
 
+WebAssemblyAsmTypeCheck::WebAssemblyAsmTypeCheck(MCAsmParser &Parser,
+                                                 const MCInstrInfo &MII,
+                                                 bool is64)
+    : Parser(Parser), MII(MII), is64(is64) {}
+
 void WebAssemblyAsmTypeCheck::funcDecl(const wasm::WasmSignature &Sig) {
   LocalTypes.assign(Sig.Params.begin(), Sig.Params.end());
   ReturnTypes.assign(Sig.Returns.begin(), Sig.Returns.end());
 }
 
 void WebAssemblyAsmTypeCheck::localDecl(
     const SmallVectorImpl<wasm::ValType> &Locals) {
   LocalTypes.insert(LocalTypes.end(), Locals.begin(), Locals.end());
if (Unreachable)
     return false;
   TypeErrorThisFunction = true;
   dumpTypeStack("current stack: ");
   return Parser.Error(ErrorLoc, Msg);
 }
 
 bool WebAssemblyAsmTypeCheck::popType(SMLoc ErrorLoc,
                                       std::optional<wasm::ValType> EVT) {
-  if (Stack.empty()) {
+  return popType(Stack, ErrorLoc, EVT);
+}
+bool WebAssemblyAsmTypeCheck::popType(SmallVectorImpl<wasm::ValType> &PopStack,
+                                      SMLoc ErrorLoc,
+                                      std::optional<wasm::ValType> EVT) {
+  if (PopStack.empty()) {
     return typeError(ErrorLoc,
                      EVT ? StringRef("empty stack while popping ") +
                                WebAssembly::typeToString(*EVT)
                          : StringRef("empty stack while popping value"));
   }
-  auto PVT = Stack.pop_back_val();
+  auto PVT = PopStack.pop_back_val();
   if (EVT && *EVT != PVT) {
     return typeError(ErrorLoc,
                      StringRef("popped ") + WebAssembly::typeToString(PVT) +
                          ", expected " + WebAssembly::typeToString(*EVT));
   }
   return false;
 }
 
bool WebAssemblyAsmTypeCheck::popRefType(SMLoc ErrorLoc) {
   return false;
 }
 
 bool WebAssemblyAsmTypeCheck::getLocal(SMLoc ErrorLoc, const MCInst &Inst,
                                        wasm::ValType &Type) {
   auto Local = static_cast<size_t>(Inst.getOperand(0).getImm());
   if (Local >= LocalTypes.size())
     return typeError(ErrorLoc, StringRef("no local type specified for index ") +
                                    std::to_string(Local));
   Type = LocalTypes[Local];
   return false;
 }
 
-bool WebAssemblyAsmTypeCheck::checkEnd(SMLoc ErrorLoc, bool PopVals) {
-  if (LastSig.Returns.size() > Stack.size())
-    return typeError(ErrorLoc, "end: insufficient values on the type stack");
+static std::optional<std::string>
+checkStackTop(const SmallVectorImpl<wasm::ValType> &ExpectedStackTop,
+              const SmallVectorImpl<wasm::ValType> &Got) {
+  for (size_t I = 0; I < ExpectedStackTop.size(); I++) {
+    auto EVT = ExpectedStackTop[I];
+    auto PVT = Got[Got.size() - ExpectedStackTop.size() + I];
+    if (PVT != EVT)
+      return std::string{"got "} + WebAssembly::typeToString(PVT) +
+             ", expected " + WebAssembly::typeToString(EVT);
+  }
+  return std::nullopt;
+}
 
-  if (PopVals) {
-    for (auto VT : llvm::reverse(LastSig.Returns)) {
-      if (popType(ErrorLoc, VT))
-        return true;
-    }
-    return false;
-  }
+bool WebAssemblyAsmTypeCheck::checkBr(SMLoc ErrorLoc, const MCInst &Inst) {
+  const MCOperand &Operand = Inst.getOperand(0);
+  if (!Operand.isImm())
+    return false;
+  int64_t BrLevel = Operand.getImm();
+  if (BrStack.size() <= static_cast<size_t>(BrLevel)) {
+    if (BrStack.empty())
+      return typeError(ErrorLoc, StringRef("br: invalid depth ") +
+                                     std::to_string(BrLevel));
+    return typeError(ErrorLoc, StringRef("br: invalid depth ") +
+                                   std::to_string(BrLevel) + " (max " +
+                                   std::to_string(BrStack.size() - 1) + ")");
+  }
+  const llvm::WebAssemblyAsmOperandFrame &Frame =
+      BrStack[BrStack.size() - BrLevel - 1];
+  std::optional<std::string> StackCheckResult =
+      checkStackTop(Frame.getResultType(), Stack);
+  if (StackCheckResult)
+    return typeError(ErrorLoc,
+                     StringRef{"br "} + StringRef{StackCheckResult.value()});
+  return false;
+
+bool WebAssemblyAsmTypeCheck::checkBlockIn(
+    WebAssemblyAsmOperandFrame::FrameType Type, SMLoc ErrorLoc,
+    const MCInst &Inst) {
+  BrStack.push_back(WebAssemblyAsmOperandFrame{Type, Stack, LastSig});
+  // Check the block input params
+  WebAssemblyAsmOperandFrame::OperandStack EnterStack =
+      BrStack.back().getEnterStack();
+  for (wasm::ValType VT : llvm::reverse(LastSig.Params))
+    if (popType(EnterStack, ErrorLoc, VT))
+      return true;
 
-  for (size_t i = 0; i < LastSig.Returns.size(); i++) {
-    auto EVT = LastSig.Returns[i];
-    auto PVT = Stack[Stack.size() - LastSig.Returns.size() + i];
-    if (PVT != EVT)
-      return typeError(
-          ErrorLoc, StringRef("end got ") + WebAssembly::typeToString(PVT) +
-                        ", expected " + WebAssembly::typeToString(EVT));
+bool WebAssemblyAsmTypeCheck::checkEnd(SMLoc ErrorLoc, bool RecoverEnter) {
+  if (LastSig.Returns.size() > Stack.size())
+    return typeError(ErrorLoc, "end: insufficient values on the type stack");
+
+  std::optional<std::string> StackCheckResult =
+      checkStackTop(LastSig.Returns, Stack);
+
+  if (StackCheckResult)
+    return typeError(ErrorLoc,
+                     StringRef{"end "} + StringRef{StackCheckResult.value()});
+
+  if (RecoverEnter)
+    // For nice nested `else`, BrStack.back() stores enter stack of `if`.
+    Stack = BrStack.back().getEnterStack();
+  else {
+    // In some cases (unreachable / br), `Stack` will be invalid and need to be
+    // recovered.
+    if (Unreachable)
+      Stack = BrStack.pop_back_val().applySignature();
+    else
+      BrStack.pop_back();
   }
+  Unreachable = false;
+
   return false;
 }
 
 bool WebAssemblyAsmTypeCheck::checkSig(SMLoc ErrorLoc,
-                                       const wasm::WasmSignature& Sig) {
+                                       const wasm::WasmSignature &Sig) {
   for (auto VT : llvm::reverse(Sig.Params))
-    if (popType(ErrorLoc, VT)) return true;
+    if (popType(ErrorLoc, VT))
+      return true;
   Stack.insert(Stack.end(), Sig.Returns.begin(), Sig.Returns.end());
   return false;
 }
 
 bool WebAssemblyAsmTypeCheck::getSymRef(SMLoc ErrorLoc, const MCInst &Inst,
                                         const MCSymbolRefExpr *&SymRef) {
   auto Op = Inst.getOperand(0);
   if (!Op.isExpr())
     return typeError(ErrorLoc, StringRef("expected expression operand"));
case MCSymbolRefExpr::VK_WASM_GOT_TLS:
       Type = is64 ? wasm::ValType::I64 : wasm::ValType::I32;
       return false;
     default:
       break;
     }
     [[fallthrough]];
   default:
     return typeError(ErrorLoc, StringRef("symbol ") + WasmSym->getName() +
-                                    " missing .globaltype");
   }
   return false;
 }
 
 bool WebAssemblyAsmTypeCheck::getTable(SMLoc ErrorLoc, const MCInst &Inst,
                                        wasm::ValType &Type) {
   const MCSymbolRefExpr *SymRef;
   if (getSymRef(ErrorLoc, Inst, SymRef))
if (popType(ErrorLoc, wasm::ValType::I32))
       return true;
     if (popType(ErrorLoc, wasm::ValType::I32))
       return true;
     if (popType(ErrorLoc, Type))
       return true;
   } else if (Name == "drop") {
     if (popType(ErrorLoc, {}))
       return true;
+  } else if (Name == "loop") {
+    if (checkBlockIn(WebAssemblyAsmOperandFrame::FrameType::Loop, ErrorLoc,
+                     Inst))
+      return true;
+  } else if (Name == "block") {
+    if (checkBlockIn(WebAssemblyAsmOperandFrame::FrameType::Block, ErrorLoc,
+                     Inst))
+      return true;
+  } else if (Name == "try") {
+    if (checkBlockIn(WebAssemblyAsmOperandFrame::FrameType::Try, ErrorLoc,
+                     Inst))
+      return true;
   } else if (Name == "end_block" || Name == "end_loop" || Name == "end_if" ||
-             Name == "else" || Name == "end_try") {
+             Name == "else" || Name == "end_try" || Name == "delegate") {
     if (checkEnd(ErrorLoc, Name == "else"))
       return true;
-    if (Name == "end_block")
-      Unreachable = false;
+  } else if (Name == "br") {
+    // TODO: br_if, br_table
+    if (checkBr(ErrorLoc, Inst))
+      return true;
+    Unreachable = true;
   } else if (Name == "return") {
     if (endOfFunction(ErrorLoc))
       return true;
   } else if (Name == "call_indirect" || Name == "return_call_indirect") {
     // Function value.
-    if (popType(ErrorLoc, wasm::ValType::I32)) return true;
-    if (checkSig(ErrorLoc, LastSig)) return true;
+    if (popType(ErrorLoc, wasm::ValType::I32))
+      return true;
+    if (checkSig(ErrorLoc, LastSig))
+      return true;
     if (Name == "return_call_indirect" && endOfFunction(ErrorLoc))
       return true;
   } else if (Name == "call" || Name == "return_call") {
     const MCSymbolRefExpr *SymRef;
     if (getSymRef(Operands[1]->getStartLoc(), Inst, SymRef))
       return true;
     auto WasmSym = cast<MCSymbolWasm>(&SymRef->getSymbol());
     auto Sig = WasmSym->getSignature();
     if (!Sig || WasmSym->getType() != wasm::WASM_SYMBOL_TYPE_FUNCTION)
       return typeError(Operands[1]->getStartLoc(), StringRef("symbol ") +
                                                        WasmSym->getName() +
                                                        " missing .functype");
-    if (checkSig(ErrorLoc, *Sig)) return true;
+    if (checkSig(ErrorLoc, *Sig))
+      return true;
     if (Name == "return_call" && endOfFunction(ErrorLoc))
       return true;
   } else if (Name == "catch") {
+    Unreachable = false;
     const MCSymbolRefExpr *SymRef;
     if (getSymRef(Operands[1]->getStartLoc(), Inst, SymRef))
       return true;
     const auto *WasmSym = cast<MCSymbolWasm>(&SymRef->getSymbol());
     const auto *Sig = WasmSym->getSignature();
     if (!Sig || WasmSym->getType() != wasm::WASM_SYMBOL_TYPE_TAG)
       return typeError(Operands[1]->getStartLoc(), StringRef("symbol ") +
                                                        WasmSym->getName() +
                                                        " missing .tagtype");
-    // catch instruction pushes values whose types are specified in the tag's
-    // "params" part
+    // if nest structure is good, last BrStack is operand stack in try instr;
+    Stack = BrStack.back().getEnterStack();
+    // catch instruction pushes values whose types are specified in the
+    // tag's "params" part
     Stack.insert(Stack.end(), Sig->Params.begin(), Sig->Params.end());
-  } else if (Name == "unreachable") {
+  } else if (Name == "unreachable" || Name == "throw") {
     Unreachable = true;
   } else if (Name == "ref.is_null") {
     if (popRefType(ErrorLoc))
       return true;
     Stack.push_back(wasm::ValType::I32);
   } else {
     // The current instruction is a stack instruction which doesn't have
     // explicit operands that indicate push/pop types, so we get those from
if (Name == "local.get") {
     }
     // Now push all the defs onto the stack.
     for (unsigned I = 0; I < II.getNumDefs(); I++) {
       const auto &Op = II.operands()[I];
       assert(Op.OperandType == MCOI::OPERAND_REGISTER && "Register expected");
       auto VT = WebAssembly::regClassToValType(Op.RegClass);
       Stack.push_back(VT);
     }
+    if (Name == "if" &&
+        checkBlockIn(WebAssemblyAsmOperandFrame::FrameType::If, ErrorLoc, Inst))
+      return true;
   }
   return false;
 }
 
 } // end namespace llvm

llvm/test/MC/WebAssembly/basic-assembly.s

.LBB0_2:
     i32.const   1
     br          2
     end_block            # second entry jumps here.
     i32.const   2
     br          1
     end_block            # default jumps here.
     i32.const   3
     end_block            # "switch" exit.
+    drop
+    drop
+    i32.const 1
+    if                   # void
+    i32.const 1
     if                   # void
-    if          i32
     end_if
     else
     end_if
-    drop
     block       void
     i32.const   2
     return
     end_block
     block       void
     return_call something3
     end_block
     block       void

 # CHECK-NEXT:      i32.const   1
 # CHECK-NEXT:      br          2       # 2: down to label2
 # CHECK-NEXT:      end_block           # label4:
 # CHECK-NEXT:      i32.const   2
 # CHECK-NEXT:      br          1       # 1: down to label2
 # CHECK-NEXT:      end_block           # label3:
 # CHECK-NEXT:      i32.const   3
 # CHECK-NEXT:      end_block           # label2:
+# CHECK-NEXT:      drop
+# CHECK-NEXT:      drop
+# CHECK-NEXT:      i32.const 1
+# CHECK-NEXT:      if
+# CHECK-NEXT:      i32.const 1
 # CHECK-NEXT:      if
-# CHECK-NEXT:      if          i32
 # CHECK-NEXT:      end_if
 # CHECK-NEXT:      else
 # CHECK-NEXT:      end_if
-# CHECK-NEXT:      drop
 # CHECK-NEXT:      block
 # CHECK-NEXT:      i32.const   2
 # CHECK-NEXT:      return
 # CHECK-NEXT:      end_block
 # CHECK-NEXT:      block
 # CHECK-NEXT:      return_call something3
 # CHECK-NEXT:      end_block
 # CHECK-NEXT:      block

llvm/test/MC/WebAssembly/type-checker-control-flow.s

+# RUN: llvm-mc -triple=wasm32 -mattr=+exception-handling %s 2>&1
+
+# Check type checker for control flow instructions 
+
+br_block:
+  .functype br_block () -> (i32)
+  block i32
+    i32.const 1
+    br 0
+  end_block
+  end_function
+# CHECK-LABEL: br_block:
+# CHECK-NEXT: .functype br_block () -> (i32)
+# CHECK-NEXT: .local  i32
+# CHECK-NEXT: block i32
+# CHECK-NEXT: i32.const 1
+# CHECK-NEXT: br 0
+# CHECK-NEXT: end_block
+# CHECK-NEXT: end_function
+
+br_loop:
+  .functype br_loop () -> (i32)
+  loop i32
+    br 0
+    i32.const 2
+  end_loop
+  end_function
+# CHECK-LABEL: br_loop:
+# CHECK-NEXT: .functype br_loop () -> (i32)
+# CHECK-NEXT: loop i32
+# CHECK-NEXT: br 0
+# CHECK-NEXT: i32.const 2
+# CHECK-NEXT: end_loop
+# CHECK-NEXT: end_function
+
+br_if_block:
+  .functype br_if_block () -> (i32)
+  i32.const 3
+  if i32
+    i32.const 4
+    br 0
+  else
+    i32.const 5
+    br 0
+  end_if
+  end_function
+# CHECK-LABEL: br_if_block:
+# CHECK-NEXT: .functype br_if_block () -> (i32)
+# CHECK-NEXT: i32.const 3
+# CHECK-NEXT: if i32
+# CHECK-NEXT: i32.const 4
+# CHECK-NEXT: br 0
+# CHECK-NEXT: else
+# CHECK-NEXT: i32.const 5
+# CHECK-NEXT: br 0
+# CHECK-NEXT: end_if
+# CHECK-NEXT: end_function
+
+br_try:
+  .functype br_try () -> ()
+  .tagtype tag_f32 f32
+  try i32
+    i32.const 1
+    br 0
+  catch tag_f32
+    i32.trunc_f32_s
+    br 0
+  end_try
+  drop
+  end_function
+# CHECK-LABEL: br_try:
+# CHECK-NEXT: .functype br_try () -> ()
+# CHECK-NEXT: .tagtype tag_f32 f32
+# CHECK-NEXT: try i32
+# CHECK-NEXT: i32.const 1
+# CHECK-NEXT: br 0
+# CHECK-NEXT: catch tag_f32
+# CHECK-NEXT: i32.trunc_f32_s
+# CHECK-NEXT: br 0
+# CHECK-NEXT: end_try
+# CHECK-NEXT: drop
+# CHECK-NEXT: end_function
+
+delegate:
+  .functype delegate () -> ()
+  .tagtype tag_i32 i32
+  try i32
+    try f32
+        f32.const 1.0
+    delegate 0
+    i32.trunc_f32_s
+    br 0
+  catch tag_i32
+  end_try
+  drop
+  end_function
+# CHECK-LABEL: delegate:
+# CHECK-NEXT: .functype delegate () -> ()
+# CHECK-NEXT: .tagtype tag_i32 i32
+# CHECK-NEXT: try i32
+# CHECK-NEXT: try f32
+# CHECK-NEXT: f32.const 1.0
+# CHECK-NEXT: delegate 0
+# CHECK-NEXT: i32.trunc_f32_s
+# CHECK-NEXT: br 0
+# CHECK-NEXT: catch tag_i32
+# CHECK-NEXT: end_try
+# CHECK-NEXT: drop
+# CHECK-NEXT: end_function
+# CHECK-LABEL: delegate:
+
+recove_stack_after_br:
+  .functype recove_stack_after_br () -> (i32)
+  block i32
+    block i32
+      i32.const 1
+      br 0
+      i32.const 1
+    end_block
+  end_block
+  end_function
+# CHECK-LABEL: recove_stack_after_br:
+# CHECK-NEXT: .functype recove_stack_after_br () -> (i32)
+# CHECK-NEXT: .local  i32
+# CHECK-NEXT: block i32
+# CHECK-NEXT: block i32
+# CHECK-NEXT: i32.const 1
+# CHECK-NEXT: br 0
+# CHECK-NEXT: end_block
+# CHECK-NEXT: end_block
+# CHECK-NEXT: end_function

llvm/test/MC/WebAssembly/type-checker-errors.s

 
 other_insn_test_3:
   .functype other_insn_test_3 () -> ()
   f32.const 1.0
   f32.const 2.0
   f32.add
 # CHECK: :[[@LINE+1]]:3: error: 1 superfluous return values
   end_function
+
+br_invalid_type:
+  .functype br_invalid_type () -> (i32)
+  .local  i32
+  local.get 0
+  loop (i32) -> (i32)
+    if i32
+      f32.const 0.0
+# CHECK: :[[@LINE+1]]:7: error: br got f32, expected i32
+      br 1
+    else
+      i32.const 0
+    end_if
+  end_loop
+  end_function
+
+br_invalid_depth:
+  .functype br_invalid_depth () -> (i32)
+  .local  i32
+  loop i32
+    local.get 0
+    if i32
+# CHECK: :[[@LINE+1]]:7: error: br: invalid depth 10 (max 2)
+      br 10
+    else
+      i32.const 0
+    end_if
+  end_loop
+  end_function
+
+invalid_block_params:
+  .functype invalid_block_params () -> (i32)
+# CHECK: :[[@LINE+1]]:3: error: empty stack while popping i32
+  block (i32) -> ()
+  end_block
+  end_function
+
+br_try:
+  .functype br_try () -> ()
+  .tagtype tag_f32 f32
+  try i32
+    i32.const 1
+    br 0
+  catch tag_f32
+# CHECK: :[[@LINE+1]]:5: error: br got f32, expected i32
+    br 0
+  end_try
+  drop
+  end_function