Fix validation and inlining bugs (#5301)

Inlining had a bug where it gave return_calls in inlined callees concrete types
even when they should have remained unreachable. This bug flew under the radar
because validation had a bug where it allowed expressions to have concrete types
when they should have been unreachable. The fuzzer found this bug by adding
another pass after inlining where the unexpected types caused an assertion
failure.

Fix the bugs and add a test that would have triggered the inlining bug.
Unfortunately the test would have also passed before this change due to the
validation bug, but it's better than nothing.

Fixes #5294.

1 files changed, 40 insertions, 4 deletions

diff --git a/test/lit/passes/inlining-unreachable.wast b/test/lit/passes/inlining-unreachable.wast
index 4cec297e4..054d73545 100644
--- a/test/lit/passes/inlining-unreachable.wast
+++ b/test/lit/passes/inlining-unreachable.wast
@@ -1,6 +1,6 @@
 ;; NOTE: Assertions have been generated by update_lit_checks.py --all-items and should not be edited.
 
-;; RUN: foreach %s %t wasm-opt --inlining -S -o - | filecheck %s
+;; RUN: foreach %s %t wasm-opt -all --inlining -S -o - | filecheck %s
 
 ;; Test that we inline functions with unreachable bodies. This is important to
 ;; propagate the trap to the caller (where it might lead to DCE).
@@ -13,7 +13,7 @@
 
   ;; CHECK:      (type $none_=>_i32 (func (result i32)))
 
-  ;; CHECK:      (func $call-trap
+  ;; CHECK:      (func $call-trap (type $none_=>_none)
   ;; CHECK-NEXT:  (block $__inlined_func$trap
   ;; CHECK-NEXT:   (unreachable)
   ;; CHECK-NEXT:   (br $__inlined_func$trap)
@@ -31,7 +31,7 @@
     (unreachable)
   )
 
-  ;; CHECK:      (func $call-trap-result (result i32)
+  ;; CHECK:      (func $call-trap-result (type $none_=>_i32) (result i32)
   ;; CHECK-NEXT:  (block $__inlined_func$trap-result (result i32)
   ;; CHECK-NEXT:   (unreachable)
   ;; CHECK-NEXT:  )
@@ -49,7 +49,7 @@
     (nop)
     (unreachable)
   )
-  ;; CHECK:      (func $call-contents-then-trap
+  ;; CHECK:      (func $call-contents-then-trap (type $none_=>_none)
   ;; CHECK-NEXT:  (block $__inlined_func$contents-then-trap
   ;; CHECK-NEXT:   (block
   ;; CHECK-NEXT:    (nop)
@@ -66,3 +66,39 @@
     (call $contents-then-trap)
   )
 )
+
+(module
+  ;; CHECK:      (type $i32_=>_i32 (func (param i32) (result i32)))
+
+  ;; CHECK:      (type $none_=>_none (func))
+
+  ;; CHECK:      (import "env" "imported" (func $imported (param i32) (result i32)))
+  (import "env" "imported" (func $imported (param i32) (result i32)))
+
+  ;; CHECK:      (func $caller (type $none_=>_none)
+  ;; CHECK-NEXT:  (drop
+  ;; CHECK-NEXT:   (block (result i32)
+  ;; CHECK-NEXT:    (block $__inlined_func$callee (result i32)
+  ;; CHECK-NEXT:     (br $__inlined_func$callee
+  ;; CHECK-NEXT:      (call $imported
+  ;; CHECK-NEXT:       (unreachable)
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:     )
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT: )
+  (func $caller
+    (drop
+      (call $callee)
+    )
+  )
+
+  ;; After inlining, this return_call will turn into a call, but should still be
+  ;; unreachable. Validation will fail if it is not.
+  (func $callee (result i32)
+    (return_call $imported
+      (unreachable)
+    )
+  )
+)