[Wasm GC] Fix an assertion in array.set processing in OptimizeInstructions (#5641)

1 files changed, 57 insertions, 4 deletions

diff --git a/test/lit/passes/optimize-instructions-gc.wast b/test/lit/passes/optimize-instructions-gc.wast
index adcf654d6..5711d9bc2 100644
--- a/test/lit/passes/optimize-instructions-gc.wast
+++ b/test/lit/passes/optimize-instructions-gc.wast
@@ -28,17 +28,17 @@
 
   (type $B (struct_subtype (field i32) (field i32) (field f32) $A))
 
+  ;; CHECK:      (type $void (func))
+
   ;; CHECK:      (type $B-child (struct_subtype (field i32) (field i32) (field f32) (field i64) $B))
+  ;; NOMNL:      (type $void (func))
+
   ;; NOMNL:      (type $B-child (struct_subtype (field i32) (field i32) (field f32) (field i64) $B))
   (type $B-child (struct_subtype (field i32) (field i32) (field f32) (field i64) $B))
 
   (type $empty (struct))
 
-  ;; CHECK:      (type $void (func))
-
   ;; CHECK:      (type $C (struct_subtype (field i32) (field i32) (field f64) $A))
-  ;; NOMNL:      (type $void (func))
-
   ;; NOMNL:      (type $C (struct_subtype (field i32) (field i32) (field f64) $A))
   (type $C (struct_subtype (field i32) (field i32) (field f64) $A))
 
@@ -3200,4 +3200,57 @@
       (i32.const 100)
     )
   )
+
+  ;; CHECK:      (func $set.array.null (type $void)
+  ;; CHECK-NEXT:  (local $temp (ref none))
+  ;; CHECK-NEXT:  (block ;; (replaces something unreachable we can't emit)
+  ;; CHECK-NEXT:   (drop
+  ;; CHECK-NEXT:    (local.tee $temp
+  ;; CHECK-NEXT:     (unreachable)
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:   (drop
+  ;; CHECK-NEXT:    (i32.const 2)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:   (drop
+  ;; CHECK-NEXT:    (i32.const 3)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:   (unreachable)
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT: )
+  ;; NOMNL:      (func $set.array.null (type $void)
+  ;; NOMNL-NEXT:  (local $temp (ref none))
+  ;; NOMNL-NEXT:  (block ;; (replaces something unreachable we can't emit)
+  ;; NOMNL-NEXT:   (drop
+  ;; NOMNL-NEXT:    (local.tee $temp
+  ;; NOMNL-NEXT:     (unreachable)
+  ;; NOMNL-NEXT:    )
+  ;; NOMNL-NEXT:   )
+  ;; NOMNL-NEXT:   (drop
+  ;; NOMNL-NEXT:    (i32.const 2)
+  ;; NOMNL-NEXT:   )
+  ;; NOMNL-NEXT:   (drop
+  ;; NOMNL-NEXT:    (i32.const 3)
+  ;; NOMNL-NEXT:   )
+  ;; NOMNL-NEXT:   (unreachable)
+  ;; NOMNL-NEXT:  )
+  ;; NOMNL-NEXT: )
+  (func $set.array.null
+    (local $temp (ref none))
+
+    ;; The cast of none will be inferred to be an unreachable. That does not
+    ;; propagate through the tee during this pass, however, as it only
+    ;; happens during the refinalize at the very end. We must be careful not to
+    ;; hit an internal error while processing the array.set, as its reference's
+    ;; fallthrough value has null type and not array type.
+    (array.set $array
+      (local.tee $temp
+        (ref.as_non_null
+          (ref.null none)
+        )
+      )
+      (i32.const 2)
+      (i32.const 3)
+    )
+  )
 )