Fix some fuzz bugs (#1528)

 *   remove-unused-brs: handle an if declared as returning a value despite having an unreachable condition
 *   simplify-locals: don't work on loops while the main pass is making changes, as set_locals are being tracked and modified.

4 files changed, 121 insertions, 0 deletions

diff --git a/test/passes/remove-unused-brs.txt b/test/passes/remove-unused-brs.txt
index cbfa4d5d5..378ee4812 100644
--- a/test/passes/remove-unused-brs.txt
+++ b/test/passes/remove-unused-brs.txt
@@ -10,6 +10,7 @@
  (type $8 (func (result f32)))
  (type $9 (func (param i32) (result f32)))
  (type $10 (func (param i32) (result i32)))
+ (type $11 (func (param i32 f64 i32 f64 f32 f32) (result i32)))
  (memory $0 256 256)
  (func $b0-yes (; 0 ;) (type $0) (param $i1 i32)
   (block $topmost
@@ -1845,4 +1846,29 @@
   )
   (get_local $p)
  )
+ (func $if-unreachable-but-declares-value (; 74 ;) (type $11) (param $var$0 i32) (param $var$1 f64) (param $var$2 i32) (param $var$3 f64) (param $var$4 f32) (param $var$5 f32) (result i32)
+  (local $var$6 f64)
+  (if
+   (i32.const 0)
+   (drop
+    (loop $label$3 (result i64)
+     (block $label$4 (result i64)
+      (block $label$5
+       (block $label$6
+        (set_local $var$1
+         (if (result f64)
+          (unreachable)
+          (br $label$5)
+          (f64.const 1)
+         )
+        )
+       )
+      )
+      (i64.const 1)
+     )
+    )
+   )
+  )
+  (i32.const 0)
+ )
 )
diff --git a/test/passes/remove-unused-brs.wast b/test/passes/remove-unused-brs.wast
index 7c03b5366..dbb415deb 100644
--- a/test/passes/remove-unused-brs.wast
+++ b/test/passes/remove-unused-brs.wast
@@ -1468,5 +1468,31 @@
     )
     (get_local $p)
   )
+  (func $if-unreachable-but-declares-value (param $var$0 i32) (param $var$1 f64) (param $var$2 i32) (param $var$3 f64) (param $var$4 f32) (param $var$5 f32) (result i32)
+   (local $var$6 f64)
+   (if
+    (i32.const 0)
+    (drop
+     (loop $label$3 (result i64)
+      (block $label$4 (result i64)
+       (block $label$5
+        (block $label$6
+         (set_local $var$1
+          (if (result f64)
+           (unreachable)
+           (br $label$5)
+           (f64.const 1)
+          )
+         )
+        )
+        (nop)
+       )
+       (i64.const 1)
+      )
+     )
+    )
+   )
+   (i32.const 0)
+  )
 )
 
diff --git a/test/passes/simplify-locals.txt b/test/passes/simplify-locals.txt
index 21a8ab403..acd8b4637 100644
--- a/test/passes/simplify-locals.txt
+++ b/test/passes/simplify-locals.txt
@@ -1197,4 +1197,41 @@
    )
   )
  )
+ (func $loop-modified-during-main-pass-be-careful-fuzz (; 14 ;) (type $FUNCSIG$i) (result i32)
+  (local $0 i32)
+  (nop)
+  (if (result i32)
+   (i32.const 0)
+   (block (result i32)
+    (nop)
+    (i32.const 0)
+   )
+   (block
+    (loop $label$4
+     (br $label$4)
+    )
+    (nop)
+   )
+  )
+ )
+ (func $loop-later (; 15 ;) (type $FUNCSIG$iiiiii) (param $var$0 i32) (param $var$1 i32) (param $var$2 i32) (param $var$3 i32) (param $var$4 i32) (result i32)
+  (drop
+   (loop $label$1 (result i32)
+    (block $label$2 (result i32)
+     (if
+      (i32.const 0)
+      (block $block
+       (nop)
+       (br $label$2
+        (i32.const -1)
+       )
+      )
+     )
+     (nop)
+     (i32.const -1)
+    )
+   )
+  )
+  (i32.const 0)
+ )
 )
diff --git a/test/passes/simplify-locals.wast b/test/passes/simplify-locals.wast
index 28f584f83..3d82fe0a4 100644
--- a/test/passes/simplify-locals.wast
+++ b/test/passes/simplify-locals.wast
@@ -1097,4 +1097,36 @@
     )
     (get_local $x)
   )
+  (func $loop-modified-during-main-pass-be-careful-fuzz (result i32)
+   (local $0 i32)
+   (if
+    (i32.const 0)
+    (set_local $0
+     (i32.const 0)
+    )
+    (loop $label$4
+     (br $label$4)
+    )
+   )
+   (get_local $0)
+  )
+  (func $loop-later (param $var$0 i32) (param $var$1 i32) (param $var$2 i32) (param $var$3 i32) (param $var$4 i32) (result i32)
+   (loop $label$1
+    (block $label$2
+     (if
+      (i32.const 0)
+      (block
+       (set_local $var$0
+        (i32.const -1)
+       )
+       (br $label$2)
+      )
+     )
+     (set_local $var$0
+      (i32.const -1)
+     )
+    )
+   )
+   (i32.const 0)
+  )
 )