"unknown successor value" assertion in DFA::refinePartitions

[kripken]

Testcase is based off of fuzzing the testcase from #7015, reduced.

$ bin/wasm-opt a.wat -all --type-merging --closed-world
wasm-opt: src/support/dfa_minimization.h:75: std::vector<std::vector<T> > wasm::DFA::refinePartitions(const std::vector<std::vector<State<T> > >&) [with T = wasm::HeapType]: Assertion `it != indices.end() && "unknown successor value"' failed.
Aborted

Looks like a DFA minimization issue. @tlively

a.wat.gz

[kripken]

Reduced testcase:

(module
 (type $5 (array funcref))
 (type $6 (func (result (ref $5))))

 (export "new-huge" (func $0))
 (export "func_28_invoker" (func $4))

 (func $0 (result (ref $5))
  (unreachable)
 )

 (func $3 (param $5 (ref null $6))
 )

 (func $4
 )
)

$ bin/wasm-opt b.wat -all --closed-world --type-merging
wasm-opt: src/support/dfa_minimization.h:75: std::vector<std::vector<T> > wasm::DFA::refinePartitions(const std::vector<std::vector<State<T> > >&) [with T = wasm::HeapType]: Assertion `it != indices.end() && "unknown successor value"' failed.
Aborted

[tlively]

I started looking into this and thankfully it looks like the code made assumptions about public types that are no longer true rather than there being a bug in the DFA minimization algorithm itself. I'll finish investigating and fixing as soon as I can.