Fix a bug in nominal LUB calculation (#4046)

The wrong variable was null checked, leading to segfaults.

2 files changed, 15 insertions, 1 deletions

diff --git a/src/wasm/wasm-type.cpp b/src/wasm/wasm-type.cpp
index d4f38cc2c..998d1a96b 100644
--- a/src/wasm/wasm-type.cpp
+++ b/src/wasm/wasm-type.cpp
@@ -1512,7 +1512,7 @@ HeapType TypeBounder::lub(HeapType a, HeapType b) {
         }
         currA = nextA;
       }
-      if (currB) {
+      if (nextB) {
         if (!seen.insert(nextB).second) {
           return HeapType(uintptr_t(nextB));
         }
diff --git a/test/example/type-builder-nominal.cpp b/test/example/type-builder-nominal.cpp
index f3eed5810..1904bb7ee 100644
--- a/test/example/type-builder-nominal.cpp
+++ b/test/example/type-builder-nominal.cpp
@@ -323,6 +323,20 @@ void test_subtypes() {
   }
 
   {
+    // Subtype declarations, but still no subtypes
+    std::vector<HeapType> built;
+    {
+      TypeBuilder builder(3);
+      builder[0].subTypeOf(builder[1]);
+      builder[0] = Struct{};
+      builder[1] = Struct{};
+      builder[2] = Struct{};
+      built = builder.build();
+    }
+    assert(LUB(built[0], built[2]) == HeapType::data);
+  }
+
+  {
     // Subtyping of identical types
     std::vector<HeapType> built;
     {