Merge pull request #1087 from WebAssembly/fuzz-2

Fuzz fixes

1 files changed, 9 insertions, 2 deletions

diff --git a/src/passes/MergeBlocks.cpp b/src/passes/MergeBlocks.cpp
index 1ec8843d6..2c983d991 100644
--- a/src/passes/MergeBlocks.cpp
+++ b/src/passes/MergeBlocks.cpp
@@ -63,8 +63,9 @@
 
 #include <wasm.h>
 #include <pass.h>
-#include <ast_utils.h>
 #include <wasm-builder.h>
+#include <ast_utils.h>
+#include <ast/effects.h>
 
 namespace wasm {
 
@@ -121,6 +122,11 @@ struct BreakValueDropper : public ControlFlowWalker<BreakValueDropper> {
     if (curr->value && curr->name == origin) {
       Builder builder(*getModule());
       auto* value = curr->value;
+      if (value->type == unreachable) {
+        // the break isn't even reached
+        replaceCurrent(value);
+        return;
+      }
       curr->value = nullptr;
       curr->finalize();
       replaceCurrent(builder.makeSequence(builder.makeDrop(value), curr));
@@ -129,7 +135,8 @@ struct BreakValueDropper : public ControlFlowWalker<BreakValueDropper> {
 
   void visitDrop(Drop* curr) {
     // if we dropped a br_if whose value we removed, then we are now dropping a (block (drop value) (br_if)) with type none, which does not need a drop
-    if (curr->value->type == none) {
+    // likewise, unreachable does not need to be dropped, so we just leave drops of concrete values
+    if (!isConcreteWasmType(curr->value->type)) {
       replaceCurrent(curr->value);
     }
   }