Heap2Local fuzz bug on struct.atomic.rmw.cmpxchg

[kripken]

(module
 (rec
  (type $0 (sub (shared (struct))))
  (type $1 (sub (cont $8)))
  (type $2 (sub (shared (struct))))
  (type $3 (sub final $0 (shared (struct))))
  (type $4 (shared (func (result i64))))
  (type $5 (sub final $1 (cont $8)))
  (type $6 (sub $2 (shared (struct (field (mut (ref null $6)))))))
  (type $7 (func (param i64 (ref null $5)) (result f32)))
  (type $8 (func (result i64 (ref null $4) (ref null $3) (ref (shared i31)))))
 )
 (type $9 (func))
 (elem declare func $0)
 (export "func_65_invoker" (func $2))
 (func $0 (type $8) (result i64 (ref null $4) (ref null $3) (ref (shared i31)))
  (unreachable)
 )
 (@binaryen.js.called)
 (func $1 (type $7) (param $0 i64) (param $1 (ref null $5)) (result f32)
  (local $2 (ref $6))
  (drop
   (struct.atomic.rmw.cmpxchg $6 0
    (local.tee $2
     (struct.new_default $6)
    )
    (local.get $2)
    (ref.null (shared none))
   )
  )
  (f32.const 0)
 )
 (func $2 (type $9)
  (drop
   (call $1
    (i64.const 0)
    (cont.new $5
     (ref.func $0)
    )
   )
  )
 )
)

$ bin/wasm-opt a -all --fuzz-exec --heap2local
[fuzz-exec] export func_65_invoker
[fuzz-exec] export func_65_invoker
[trap null ref]
[fuzz-exec] comparing func_65_invoker
[fuzz-exec] optimization passes changed results

[tlively]

Reduced a bit more:

(module
 (type $struct (struct (field (mut (ref null $struct)))))
 
 (func $test (export "test")
  (local $local (ref $struct))
  (drop
   (struct.atomic.rmw.cmpxchg $struct 0
    (local.tee $local
     (struct.new_default $struct)
    )
    (local.get $local)
    (ref.null none)
   )
  )
 )
)