[ir] Validate that Switch only has a single default

Fixes a ClusterFuzz issue.

Fixed: 450576722
Change-Id: I7958f4f15c094e037e46638a8944924a078944ef
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/266914
Commit-Queue: Antonio Maiorano <amaiorano@google.com>
Auto-Submit: James Price <jrprice@google.com>
Commit-Queue: James Price <jrprice@google.com>
Reviewed-by: Antonio Maiorano <amaiorano@google.com>

src/tint/lang/core/ir/validator.cc

diff --git a/src/tint/lang/core/ir/validator.cc b/src/tint/lang/core/ir/validator.cc
index e875f44..ff799e0 100644
--- a/src/tint/lang/core/ir/validator.cc
+++ b/src/tint/lang/core/ir/validator.cc
@@ -4252,6 +4252,9 @@
 
         for (const auto& sel : cse.selectors) {
             if (sel.IsDefault()) {
+                if (found_default) {
+                    AddError(s) << "multiple default selectors in switch";
+                }
                 found_default = true;
             }
         }

src/tint/lang/core/ir/validator_flow_control_test.cc

diff --git a/src/tint/lang/core/ir/validator_flow_control_test.cc b/src/tint/lang/core/ir/validator_flow_control_test.cc
index 4063936..81e7c2a 100644
--- a/src/tint/lang/core/ir/validator_flow_control_test.cc
+++ b/src/tint/lang/core/ir/validator_flow_control_test.cc
@@ -2233,6 +2233,23 @@
 )")) << res.Failure();
 }
 
+TEST_F(IR_ValidatorTest, Switch_MultipleDefaultCases) {
+    auto* f = b.Function("f", ty.void_());
+    b.Append(f->Block(), [&] {
+        auto* s = b.Switch(1_i);
+        auto* case1 = b.DefaultCase(s);
+        b.Append(case1, [&] { b.ExitSwitch(s); });
+        auto* case2 = b.DefaultCase(s);
+        b.Append(case2, [&] { b.ExitSwitch(s); });
+        b.Return(f);
+    });
+
+    auto res = ir::Validate(mod);
+    ASSERT_NE(res, Success);
+    EXPECT_THAT(res.Failure().reason,
+                testing::HasSubstr("error: switch: multiple default selectors in switch"));
+}
+
 TEST_F(IR_ValidatorTest, Switch_NoCondition) {
     auto* f = b.Function("my_func", ty.void_());