From d6c6c709659b39620e32f29b84ddc768aea580c1 Mon Sep 17 00:00:00 2001
From: Chris Fallin <chris@cfallin.org>
Date: Fri, 24 Dec 2021 14:50:23 -0800
Subject: [PATCH] fuzzbug fix

---
 src/backend/final.rs      |  2 ++
 src/backend/serialize.rs  |  2 ++
 src/backend/structured.rs | 23 ++++++++++++++++++++---
 src/frontend.rs           |  1 +
 4 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/src/backend/final.rs b/src/backend/final.rs
index 9e04a35..dd3849a 100644
--- a/src/backend/final.rs
+++ b/src/backend/final.rs
@@ -27,6 +27,7 @@ impl<'a, FT: FuncTypeSink> WasmContext<'a, FT> {
     }
 
     fn translate(&mut self, op: &SerializedOperator, locations: &Locations) {
+        log::trace!("translate: {:?}", op);
         match op {
             SerializedOperator::StartBlock {
                 ref params,
@@ -129,6 +130,7 @@ impl<'a, FT: FuncTypeSink> WasmContext<'a, FT> {
         target: &SerializedBlockTarget,
         locations: &Locations,
     ) {
+        log::trace!("translate_target: {:?}", target);
         match target {
             &SerializedBlockTarget::Fallthrough(ref ops) => {
                 for op in ops {
diff --git a/src/backend/serialize.rs b/src/backend/serialize.rs
index 96c40ae..9192c5d 100644
--- a/src/backend/serialize.rs
+++ b/src/backend/serialize.rs
@@ -246,12 +246,14 @@ impl<'a> SerializedBodyContext<'a> {
                 let targets = targets
                     .iter()
                     .map(|target| {
+                        log::trace!("target: {:?}", target);
                         let mut rev_ops = vec![];
                         for &value in target.args.iter().rev() {
                             let value = self.f.resolve_alias(value);
                             self.push_value(value, &mut rev_ops);
                         }
                         rev_ops.reverse();
+                        log::trace!(" -> ops: {:?}", rev_ops);
                         match target.relative_branch {
                             Some(branch) => SerializedBlockTarget::Branch(branch, rev_ops),
                             None => SerializedBlockTarget::Fallthrough(rev_ops),
diff --git a/src/backend/structured.rs b/src/backend/structured.rs
index a89811e..d252c41 100644
--- a/src/backend/structured.rs
+++ b/src/backend/structured.rs
@@ -310,7 +310,15 @@ impl BlockOrder {
     pub fn compute(f: &FunctionBody, cfg: &CFGInfo, wasm_region: &WasmRegion) -> BlockOrder {
         let mut target_stack = vec![];
         let mut entries = vec![];
-        Self::generate_region(f, cfg, &mut target_stack, &mut entries, wasm_region, None);
+        Self::generate_region(
+            f,
+            cfg,
+            &mut target_stack,
+            &mut entries,
+            wasm_region,
+            None,
+            true,
+        );
         log::trace!("entries: {:?}", entries);
         BlockOrder { entries }
     }
@@ -322,6 +330,7 @@ impl BlockOrder {
         entries: &mut Vec<BlockOrderEntry>,
         region: &WasmRegion,
         fallthrough: Option<BlockId>,
+        toplevel: bool,
     ) {
         log::trace!(
             "BlockOrder::generate_region: stack {:?} region {:?} fallthrough {:?}",
@@ -345,7 +354,7 @@ impl BlockOrder {
                     target_stack.push(target);
                 }
                 let params = f.blocks[header].params.clone();
-                let results = if header == 0 {
+                let results = if toplevel {
                     f.rets.clone()
                 } else {
                     match fallthrough {
@@ -370,7 +379,15 @@ impl BlockOrder {
                     } else {
                         Some(subregions[i + 1].header())
                     };
-                    Self::generate_region(f, cfg, target_stack, entries, subregion, fallthrough);
+                    Self::generate_region(
+                        f,
+                        cfg,
+                        target_stack,
+                        entries,
+                        subregion,
+                        fallthrough,
+                        false,
+                    );
                 }
 
                 entries.push(BlockOrderEntry::End);
diff --git a/src/frontend.rs b/src/frontend.rs
index 2b17c24..12ce86a 100644
--- a/src/frontend.rs
+++ b/src/frontend.rs
@@ -945,6 +945,7 @@ impl<'a, 'b> FunctionBodyBuilder<'a, 'b> {
                 };
                 // Get the frame we're branching to.
                 let frame = self.relative_frame(*relative_depth).clone();
+                log::trace!("Br/BrIf: dest frame {:?}", frame);
                 // Finally, generate the branch itself.
                 match cond {
                     None => {