work

Author: kripken

src/tools/fuzzing/fuzzing.cpp

@@ -1734,9 +1734,6 @@ void TranslateToFuzzReader::mutate(Function* func) {
   // reasonable chance of making some changes.
   percentChance = std::max(percentChance, Index(3));
 
-  // Half the time, use the SubtypingDiscoverer below.
-  bool useSubtypingDiscoverer = r & 1;
-
   // First, find things to replace and their types. SubtypingDiscoverer needs to
   // do this in a single, full walk (as types of children depend on parents, and
   // even block targets).
@@ -1774,7 +1771,7 @@ void TranslateToFuzzReader::mutate(Function* func) {
     void noteCast(Expression* src, Expression* dst) {}
   } finder;
 
-  if (useSubtypingDiscoverer) {
+  if (oneIn(2)) {
     // We read the IR here, and it must be totally valid - e.g. breaks have a
     // proper break target - or else we'd hit internal errors. Fix it up first.
     // (Otherwise, fixing it up is done once after mutation, and in that case
@@ -1820,6 +1817,8 @@ void TranslateToFuzzReader::mutate(Function* func) {
           // We can only be given a less-refined type (certainly we can replace
           // curr with its own type).
           assert(Type::isSubType(curr->type, type));
+          // We only store an interesting non-trivial type.
+          assert(type != curr->type);
         }
       }