LibWasm: Take memory_fill arguments in the right order

This makes ruffle.rs work again :^)

Libraries/LibWasm/AbstractMachine/BytecodeInterpreter.cpp

@@ -1581,6 +1581,7 @@ HANDLE_INSTRUCTION(memory_fill)
         auto instance = configuration.store().get(address);
         // bounds checked by verifier.
         auto count = configuration.take_source(0, addresses.sources).to<u32>();
+        u8 value = static_cast<u8>(configuration.take_source(1, addresses.sources).to<u32>());
         auto destination_offset = configuration.take_source(2, addresses.sources).to<u32>();
 
         Checked<u32> checked_end = destination_offset;
@@ -1591,7 +1592,6 @@ HANDLE_INSTRUCTION(memory_fill)
             TAILCALL return continue_(HANDLER_PARAMS(DECOMPOSE_PARAMS_NAME_ONLY));
 
         Instruction::MemoryArgument memarg { 0, 0, args.memory_index };
-        u8 value = static_cast<u8>(configuration.take_source(1, addresses.sources).to<u32>());
         for (u32 i = 0; i < count; ++i) {
             if (interpreter.store_to_memory(configuration, memarg, { &value, sizeof(value) }, destination_offset + i))
                 return Outcome::Return;

Libraries/LibWasm/Tests/Executor/test-memory_fill-order.js

@@ -0,0 +1,23 @@
+test("memfill executes and returns expected result", () => {
+    const bin = readBinaryWasmFile("Fixtures/Modules/memory_fill-order.wasm");
+    const module = parseWebAssemblyModule(bin);
+
+    const test_fill = module.getExport("test_fill");
+    // memory.fill off=10 value=42 size=5
+    module.invoke(test_fill);
+
+    const get_value = module.getExport("get_value");
+
+    // After memory.fill, bytes 10..14 should be filled with value 42
+    expect(module.invoke(get_value, 10)).toBe(42);
+    expect(module.invoke(get_value, 11)).toBe(42);
+    expect(module.invoke(get_value, 12)).toBe(42);
+    expect(module.invoke(get_value, 13)).toBe(42);
+    expect(module.invoke(get_value, 14)).toBe(42);
+
+    // Byte 9 (before the fill region) should still be 0
+    expect(module.invoke(get_value, 9)).toBe(0);
+
+    // Byte 15 (after the fill region) should still be 0
+    expect(module.invoke(get_value, 15)).toBe(0);
+});