Merge pull request #1154 from WebAssembly/fuzz

Fuzz fixes

2 files changed, 14 insertions, 3 deletions

diff --git a/src/passes/Inlining.cpp b/src/passes/Inlining.cpp
index 710fc00ff..192480d26 100644
--- a/src/passes/Inlining.cpp
+++ b/src/passes/Inlining.cpp
@@ -155,7 +155,6 @@ static Expression* doInlining(Module* module, Function* into, InliningAction& ac
   auto* call = (*action.callSite)->cast<Call>();
   Builder builder(*module);
   auto* block = Builder(*module).makeBlock();
-  block->type = call->type;
   block->name = Name(std::string("__inlined_func$") + from->name.str);
   *action.callSite = block;
   // set up a locals mapping
@@ -191,6 +190,16 @@ static Expression* doInlining(Module* module, Function* into, InliningAction& ac
   auto* contents = ExpressionManipulator::copy(from->body, *module);
   updater.walk(contents);
   block->list.push_back(contents);
+  block->type = call->type;
+  // if the function returned a value, we just set the block containing the
+  // inlined code to have that type. or, if the function was void and
+  // contained void, that is fine too. a bad case is a void function in which
+  // we have unreachable code, so we would be replacing a void call with an
+  // unreachable; we need to handle
+  if (contents->type == unreachable && block->type == none) {
+    // make the block reachable by adding a break to it
+    block->list.push_back(builder.makeBreak(block->name));
+  }
   return block;
 }
 
diff --git a/src/passes/RemoveUnusedBrs.cpp b/src/passes/RemoveUnusedBrs.cpp
index e627ce138..e307ec414 100644
--- a/src/passes/RemoveUnusedBrs.cpp
+++ b/src/passes/RemoveUnusedBrs.cpp
@@ -482,9 +482,11 @@ struct RemoveUnusedBrs : public WalkerPass<PostWalker<RemoveUnusedBrs>> {
             // a "selectified" condition that executes both.
             for (Index i = 0; i < list.size() - 1; i++) {
               auto* br1 = list[i]->dynCast<Break>();
-              if (!br1 || !br1->condition) continue;
+              // avoid unreachable brs, as they are dead code anyhow, and after merging
+              // them the outer scope could need type changes
+              if (!br1 || !br1->condition || br1->type == unreachable) continue;
               auto* br2 = list[i + 1]->dynCast<Break>();
-              if (!br2 || !br2->condition) continue;
+              if (!br2 || !br2->condition || br2->type == unreachable) continue;
               if (br1->name == br2->name) {
                 assert(!br1->value && !br2->value);
                 if (!EffectAnalyzer(passOptions, br2->condition).hasSideEffects()) {