Merge pull request #1119 from WebAssembly/fuzz-2

More fun fuzz fixes

4 files changed, 19 insertions, 10 deletions

diff --git a/src/ast/bits.h b/src/ast/bits.h
index 11cf7b06d..0aee50ffe 100644
--- a/src/ast/bits.h
+++ b/src/ast/bits.h
@@ -51,7 +51,8 @@ struct Bits {
     WASM_UNREACHABLE();
   }
 
-  static Index getEffectiveShifts(Const* amount) {
+  static Index getEffectiveShifts(Expression* expr) {
+    auto* amount = expr->cast<Const>();
     if (amount->type == i32) {
       return getEffectiveShifts(amount->value.geti32(), i32);
     } else if (amount->type == i64) {
diff --git a/src/ast/properties.h b/src/ast/properties.h
index 097f7a8f0..8c8655c07 100644
--- a/src/ast/properties.h
+++ b/src/ast/properties.h
@@ -79,7 +79,7 @@ struct Properties {
 
   // gets the size of the sign-extended value
   static Index getSignExtBits(Expression* curr) {
-    return 32 - curr->cast<Binary>()->right->cast<Const>()->value.geti32();
+    return 32 - Bits::getEffectiveShifts(curr->cast<Binary>()->right);
   }
 
   // Check if an expression is almost a sign-extend: perhaps the inner shift
@@ -93,7 +93,7 @@ struct Properties {
             if (auto* inner = outer->left->dynCast<Binary>()) {
               if (inner->op == ShlInt32) {
                 if (auto* innerConst = inner->right->dynCast<Const>()) {
-                  if (outerConst->value.leU(innerConst->value).geti32()) {
+                  if (Bits::getEffectiveShifts(outerConst) <= Bits::getEffectiveShifts(innerConst)) {
                     return inner->left;
                   }
                 }
@@ -109,8 +109,8 @@ struct Properties {
   // gets the size of the almost sign-extended value, as well as the
   // extra shifts, if any
   static Index getAlmostSignExtBits(Expression* curr, Index& extraShifts) {
-    extraShifts = curr->cast<Binary>()->left->cast<Binary>()->right->cast<Const>()->value.geti32() -
-                  curr->cast<Binary>()->right->cast<Const>()->value.geti32();
+    extraShifts = Bits::getEffectiveShifts(curr->cast<Binary>()->left->cast<Binary>()->right) -
+                  Bits::getEffectiveShifts(curr->cast<Binary>()->right);
     return getSignExtBits(curr);
   }
 
diff --git a/src/passes/OptimizeInstructions.cpp b/src/passes/OptimizeInstructions.cpp
index 4fd7cbe8d..f458a58b2 100644
--- a/src/passes/OptimizeInstructions.cpp
+++ b/src/passes/OptimizeInstructions.cpp
@@ -228,8 +228,8 @@ Index getMaxBits(Expression* curr, LocalInfoProvider* localInfoProvider) {
     }
   } else if (auto* unary = curr->dynCast<Unary>()) {
     switch (unary->op) {
-      case ClzInt32: case CtzInt32: case PopcntInt32: return 5;
-      case ClzInt64: case CtzInt64: case PopcntInt64: return 6;
+      case ClzInt32: case CtzInt32: case PopcntInt32: return 6;
+      case ClzInt64: case CtzInt64: case PopcntInt64: return 7;
       case EqZInt32: case EqZInt64: return 1;
       case WrapInt64: return std::min(Index(32), getMaxBits(unary->value, localInfoProvider));
       default: {}
@@ -779,7 +779,7 @@ private:
           return;
         } else if (binary->op == ShlInt32) {
           if (auto* c = binary->right->dynCast<Const>()) {
-            seek(binary->left, mul * Pow2(c->value.geti32()));
+            seek(binary->left, mul * Pow2(Bits::getEffectiveShifts(c)));
             return;
           }
         } else if (binary->op == MulInt32) {
@@ -836,7 +836,7 @@ private:
           }
         } else if (curr->op == ShlInt32) {
           // shifting a 0 is a 0, unless the shift has side effects
-          if (left && left->value.geti32() == 0 && !EffectAnalyzer(passOptions, curr->right).hasSideEffects()) {
+          if (left && Bits::getEffectiveShifts(left) == 0 && !EffectAnalyzer(passOptions, curr->right).hasSideEffects()) {
             replaceCurrent(left);
             return;
           }
diff --git a/src/wasm/wasm-binary.cpp b/src/wasm/wasm-binary.cpp
index 88b967fdf..47bcc8ba5 100644
--- a/src/wasm/wasm-binary.cpp
+++ b/src/wasm/wasm-binary.cpp
@@ -666,6 +666,14 @@ void WasmBinaryWriter::visitSwitch(Switch *curr) {
     recurse(curr->value);
   }
   recurse(curr->condition);
+  if (!BranchUtils::isBranchTaken(curr)) {
+    // if the branch is not taken, then it's dangerous to emit it, as
+    // wasm type checking rules are stricter than ours - we tolerate
+    // an untaken branch to a target with a different value, but not
+    // wasm. so just don't emit it
+    o << int8_t(BinaryConsts::Unreachable);
+    return;
+  }
   o << int8_t(BinaryConsts::TableSwitch) << U32LEB(curr->targets.size());
   for (auto target : curr->targets) {
     o << U32LEB(getBreakIndex(target));
@@ -1796,7 +1804,7 @@ void WasmBinaryBuilder::processExpressions() { // until an end or else marker, o
 
 Expression* WasmBinaryBuilder::popExpression() {
   if (expressionStack.empty()) {
-    throw ParseException("attempted pop from empty stack");
+    throw ParseException("attempted pop from empty stack at " + std::to_string(pos));
   }
   auto ret = expressionStack.back();
   // to simulate the wasm polymorphic stack mode, leave a final