[WebAssembly] Do not assume br_table range checks will be gt_u

[tlively]

Summary

OSS-Fuzz and the Emscripten test suite uncovered some edge cases in
which the range check instruction seemed to be an (i32.const 0) or
other unexpected instruction, triggering an assertion. Unfortunately
the reproducers are rather complicated, so they don't make good unit
tests. This commit removes the bad assertion and conservatively
optimizes range checks only when the range check instruction is
i32.gt_u.

[tlively]

Landing TBR to unbreak stuff faster.

llvm/lib/Target/WebAssembly/WebAssemblyFixBrTableDefaults.cpp

MachineBasicBlock *fixBrTable(MachineInstr &MI, MachineBasicBlock *MBB,
   //  D  |  J  | Header jumps to the default and also to the jump table
   if (TBB && TBB != MBB) {
     assert((FBB == nullptr || FBB == MBB) &&
            "Expected jump or fallthrough to br_table block");
     assert(Cond.size() == 2 && Cond[1].isReg() && "Unexpected condition info");
 
     // If the range check checks an i64 value, we cannot optimize it out because
     // the i64 index is truncated to an i32, making values over 2^32
-    // indistinguishable from small numbers.
+    // indistinguishable from small numbers. There are also other strange edge
+    // cases that can arise in practice that we don't want to reason about, so
+    // conservatively only perform the optimization if the range check is the
+    // normal case of an i32.gt_u.
     MachineRegisterInfo &MRI = MF.getRegInfo();
     auto *RangeCheck = MRI.getVRegDef(Cond[1].getReg());
     assert(RangeCheck != nullptr);
-    unsigned RangeCheckOp = RangeCheck->getOpcode();
-    assert(RangeCheckOp == WebAssembly::GT_U_I32 ||
-           RangeCheckOp == WebAssembly::GT_U_I64);
-    if (RangeCheckOp == WebAssembly::GT_U_I64) {
-      // Bail out and leave the jump table untouched
+    if (RangeCheck->getOpcode() != WebAssembly::GT_U_I32)
       return nullptr;
-    }
 
     // Remove the dummy default target and install the real one.
     MI.RemoveOperand(MI.getNumExplicitOperands() - 1);
     MI.addOperand(MF, MachineOperand::CreateMBB(TBB));
   }
 
   // Remove any branches from the header and splice in the jump table instead
   TII.removeBranch(*HeaderMBB, nullptr);