link: run fpcast-emu before optimization passes

test/core/test_emulate_function_pointer_casts_directize.c

@@ -0,0 +1,22 @@
+/*
+ * Regression test: fpcast-emu must run before directize (inside -O2).
+ * Otherwise directize sees the type-mismatched call_indirect (calling a
+ * 1-arg function through a 2-arg pointer) and replaces it with unreachable.
+ */
+#include <stdio.h>
+
+typedef void (*two_arg_fn)(void *, void *);
+
+static void one_arg(void *p) { printf("OK\n"); }
+
+static two_arg_fn hide_cast(void (*fn)(void *)) {
+  two_arg_fn result = (two_arg_fn)fn;
+  __asm__("" : "+r"(result));
+  return result;
+}
+
+int main(void) {
+  two_arg_fn fn = hide_cast(one_arg);
+  fn((void *)1, (void *)2);
+  return 0;
+}

test/core/test_emulate_function_pointer_casts_directize.out

@@ -0,0 +1 @@
+OK

test/test_core.py

@@ -7307,6 +7307,12 @@ def test_emulate_function_pointer_casts(self):
     self.set_setting('EMULATE_FUNCTION_POINTER_CASTS')
     self.do_core_test('test_emulate_function_pointer_casts.cpp', cflags=['-Wno-deprecated'])
 
+  def test_emulate_function_pointer_casts_directize(self):
+    # Regression test: directize (inside -O2) must not replace type-mismatched
+    # call_indirect with unreachable when fpcast-emu will fix them.
+    # https://github.com/WebAssembly/binaryen/pull/8475
+    self.do_core_test('test_emulate_function_pointer_casts_directize.c', cflags=['-sEMULATE_FUNCTION_POINTER_CASTS'])
+
   @no_wasm2js('TODO: nicely printed names in wasm2js')
   @no_bun('https://github.com/emscripten-core/emscripten/issues/26197')
   @parameterized({

tools/link.py

@@ -344,6 +344,11 @@ def get_binaryen_passes(options):
   # safe heap must run before post-emscripten, so post-emscripten can apply the sbrk ptr
   if settings.SAFE_HEAP:
     passes += ['--safe-heap']
+  if settings.EMULATE_FUNCTION_POINTER_CASTS:
+    # fpcast-emu must run before -Ox so that directize (inside -Ox) sees
+    # the rewritten table entries with matching types. It must also run
+    # before asyncify so the byn$fpcast-emu thunks get instrumented.
+    passes += ['--fpcast-emu']
   if optimizing:
     # wasm-emscripten-finalize will strip the features section for us
     # automatically, but if we did not modify the wasm then we didn't run it,
@@ -372,11 +377,6 @@ def get_binaryen_passes(options):
       # legalize it again now, as the instrumentation may need it
       passes += ['--legalize-js-interface']
       passes += building.js_legalization_pass_flags()
-  if settings.EMULATE_FUNCTION_POINTER_CASTS:
-    # note that this pass must run before asyncify, as if it runs afterwards we only
-    # generate the  byn$fpcast_emu  functions after asyncify runs, and so we wouldn't
-    # be able to further process them.
-    passes += ['--fpcast-emu']
   if settings.ASYNCIFY == 1:
     passes += ['--asyncify']
     if settings.MAIN_MODULE: