Merge pull request #1154 from WebAssembly/fuzz

Fuzz fixes

3 files changed, 21 insertions, 10 deletions

diff --git a/src/passes/Inlining.cpp b/src/passes/Inlining.cpp
index 710fc00ff..192480d26 100644
--- a/src/passes/Inlining.cpp
+++ b/src/passes/Inlining.cpp
@@ -155,7 +155,6 @@ static Expression* doInlining(Module* module, Function* into, InliningAction& ac
   auto* call = (*action.callSite)->cast<Call>();
   Builder builder(*module);
   auto* block = Builder(*module).makeBlock();
-  block->type = call->type;
   block->name = Name(std::string("__inlined_func$") + from->name.str);
   *action.callSite = block;
   // set up a locals mapping
@@ -191,6 +190,16 @@ static Expression* doInlining(Module* module, Function* into, InliningAction& ac
   auto* contents = ExpressionManipulator::copy(from->body, *module);
   updater.walk(contents);
   block->list.push_back(contents);
+  block->type = call->type;
+  // if the function returned a value, we just set the block containing the
+  // inlined code to have that type. or, if the function was void and
+  // contained void, that is fine too. a bad case is a void function in which
+  // we have unreachable code, so we would be replacing a void call with an
+  // unreachable; we need to handle
+  if (contents->type == unreachable && block->type == none) {
+    // make the block reachable by adding a break to it
+    block->list.push_back(builder.makeBreak(block->name));
+  }
   return block;
 }
 
diff --git a/src/passes/RemoveUnusedBrs.cpp b/src/passes/RemoveUnusedBrs.cpp
index e627ce138..e307ec414 100644
--- a/src/passes/RemoveUnusedBrs.cpp
+++ b/src/passes/RemoveUnusedBrs.cpp
@@ -482,9 +482,11 @@ struct RemoveUnusedBrs : public WalkerPass<PostWalker<RemoveUnusedBrs>> {
             // a "selectified" condition that executes both.
             for (Index i = 0; i < list.size() - 1; i++) {
               auto* br1 = list[i]->dynCast<Break>();
-              if (!br1 || !br1->condition) continue;
+              // avoid unreachable brs, as they are dead code anyhow, and after merging
+              // them the outer scope could need type changes
+              if (!br1 || !br1->condition || br1->type == unreachable) continue;
               auto* br2 = list[i + 1]->dynCast<Break>();
-              if (!br2 || !br2->condition) continue;
+              if (!br2 || !br2->condition || br2->type == unreachable) continue;
               if (br1->name == br2->name) {
                 assert(!br1->value && !br2->value);
                 if (!EffectAnalyzer(passOptions, br2->condition).hasSideEffects()) {
diff --git a/src/tools/translate-to-fuzz.h b/src/tools/translate-to-fuzz.h
index 307604af6..74a457013 100644
--- a/src/tools/translate-to-fuzz.h
+++ b/src/tools/translate-to-fuzz.h
@@ -259,16 +259,16 @@ private:
     labelIndex = 0;
     assert(breakableStack.empty());
     assert(hangStack.empty());
+    // with small chance, make the body unreachable
+    auto bodyType = func->result;
+    if (oneIn(10)) {
+      bodyType = unreachable;
+    }
     // with reasonable chance make the body a block
     if (oneIn(2)) {
-      func->body = makeBlock(func->result);
+      func->body = makeBlock(bodyType);
     } else {
-      // with very small chance, make the body unreachable
-      if (oneIn(20)) {
-        func->body = make(unreachable);
-      } else {
-        func->body = make(func->result);
-      }
+      func->body = make(bodyType);
     }
     if (HANG_LIMIT > 0) {
       func->body = builder.makeSequence(