Optimization bug in wasm-opt

[mkustermann]

(At commit 6bb9fe2)

% tar xvf issue1.tar.gz
issue1.wasm
issue1.mjs
pkg/dart2wasm/bin/run_wasm.js

Run with with D8:

% d8  $PWD/pkg/dart2wasm/bin/run_wasm.js -- $PWD/issue1.mjs $PWD/issue1.wasm
% echo $?
0

Optimize with wasm-opt:

% wasm-opt --enable-gc --enable-reference-types --enable-multivalue --enable-exception-handling \
    --enable-nontrapping-float-to-int --enable-sign-ext --enable-bulk-memory --enable-threads \
    --enable-simd '--no-inline=*<noInline>*' \
    --closed-world --traps-never-happen --type-unfinalizing \
    -Os --type-ssa --gufa -Os --type-merging -Os --type-finalizing --minimize-rec-groups \
    -g issue1.wasm -o issue1.wasm

and run:

% d8  $PWD/pkg/dart2wasm/bin/run_wasm.js -- $PWD/issue1.mjs $PWD/issue1.wasm
wasm-function[50]:0x3d20: RuntimeError: unreachable
RuntimeError: unreachable
    at module0.test inner (wasm://wasm/module0-0001c11a:wasm-function[50]:0x3d20)
    at module0._invokeMain (wasm://wasm/module0-0001c11a:wasm-function[12]:0x353e)
    at InstantiatedApp.invokeMain (/tmp/issue1/issue1.mjs:162:37)
    at main (/tmp/issue1/pkg/dart2wasm/bin/run_wasm.js:428:21)
    at async action (/tmp/issue1/pkg/dart2wasm/bin/run_wasm.js:353:38)
    at async eventLoop (/tmp/issue1/pkg/dart2wasm/bin/run_wasm.js:329:9)

1 pending unhandled Promise rejection(s) detected.

[mkustermann]

issue1.tar.gz

[kripken]

Simpler STR: adding BINARYEN_PASS_DEBUG=1 in the env leads to a validation error after type-merging. Bisected to the same thing, #8792 , so this is likely the same as what our fuzzer found and as #8799