4 files changed, 16 insertions, 7 deletions
diff --git a/lib/Bitcode/NaCl/Reader/NaClBitcodeReader.cpp b/lib/Bitcode/NaCl/Reader/NaClBitcodeReader.cpp
index 276d1d59b3..f5fd1ba0e7 100644
--- a/lib/Bitcode/NaCl/Reader/NaClBitcodeReader.cpp
+++ b/lib/Bitcode/NaCl/Reader/NaClBitcodeReader.cpp
@@ -1579,8 +1579,16 @@ bool NaClBitcodeReader::ParseFunctionBody(Function *F) {
     }
 
     // Non-void values get registered in the value table for future use.
-    if (I && !I->getType()->isVoidTy())
-      ValueList.AssignValue(I, NextValueNo++);
+    if (I && !I->getType()->isVoidTy()) {
+      Value *NewVal = I;
+      if (GetPNaClVersion() >= 2 &&
+          NewVal->getType()->isPointerTy() &&
+          ValueList.getValueFwdRef(NextValueNo)) {
+        // Forward-referenced values cannot have pointer type.
+        NewVal = ConvertOpToScalar(NewVal, CurBBNo);
+      }
+      ValueList.AssignValue(NewVal, NextValueNo++);
+    }
   }
 
 OutOfRecordLoop:
diff --git a/lib/Bitcode/NaCl/Writer/NaClBitcodeWriter.cpp b/lib/Bitcode/NaCl/Writer/NaClBitcodeWriter.cpp
index 6432740ba2..923d0b2c1e 100644
--- a/lib/Bitcode/NaCl/Writer/NaClBitcodeWriter.cpp
+++ b/lib/Bitcode/NaCl/Writer/NaClBitcodeWriter.cpp
@@ -550,7 +550,7 @@ static void EmitFnForwardTypeRef(const Value *V,
       VE.InsertFnForwardTypeRef(ValID)) {
     SmallVector<unsigned, 2> Vals;
     Vals.push_back(ValID);
-    Vals.push_back(VE.getTypeID(V->getType()));
+    Vals.push_back(VE.getTypeID(VE.NormalizeScalarType(V->getType())));
     Stream.EmitRecord(naclbitc::FUNC_CODE_INST_FORWARDTYPEREF, Vals,
                       FUNCTION_INST_FORWARDTYPEREF_ABBREV);
   }
diff --git a/lib/Bitcode/NaCl/Writer/NaClValueEnumerator.cpp b/lib/Bitcode/NaCl/Writer/NaClValueEnumerator.cpp
index ca34ac9c77..cabdc420c6 100644
--- a/lib/Bitcode/NaCl/Writer/NaClValueEnumerator.cpp
+++ b/lib/Bitcode/NaCl/Writer/NaClValueEnumerator.cpp
@@ -298,7 +298,7 @@ void NaClValueEnumerator::EnumerateValue(const Value *VIn) {
 }
 
 
-Type *NaClValueEnumerator::NormalizeParamType(Type *Ty) const {
+Type *NaClValueEnumerator::NormalizeScalarType(Type *Ty) const {
   // Strip pointer types.
   if (Ty->isPointerTy() && PNaClVersion >= 2)
     Ty = IntPtrType;
@@ -309,8 +309,8 @@ Type *NaClValueEnumerator::NormalizeType(Type *Ty) const {
   if (FunctionType *FTy = dyn_cast<FunctionType>(Ty)) {
     SmallVector<Type *, 8> ArgTypes;
     for (unsigned I = 0, E = FTy->getNumParams(); I < E; ++I)
-      ArgTypes.push_back(NormalizeParamType(FTy->getParamType(I)));
-    Ty = FunctionType::get(NormalizeParamType(FTy->getReturnType()),
+      ArgTypes.push_back(NormalizeScalarType(FTy->getParamType(I)));
+    Ty = FunctionType::get(NormalizeScalarType(FTy->getReturnType()),
                            ArgTypes, false);
   }
   return Ty;
diff --git a/lib/Bitcode/NaCl/Writer/NaClValueEnumerator.h b/lib/Bitcode/NaCl/Writer/NaClValueEnumerator.h
index 5f25039e30..e756beb2f2 100644
--- a/lib/Bitcode/NaCl/Writer/NaClValueEnumerator.h
+++ b/lib/Bitcode/NaCl/Writer/NaClValueEnumerator.h
@@ -154,11 +154,12 @@ public:
     return T == IntPtrType;
   }
 
+  Type *NormalizeScalarType(Type *Ty) const;
+
 private:
   void OptimizeTypes(const Module *M);
   void OptimizeConstants(unsigned CstStart, unsigned CstEnd);
 
-  Type *NormalizeParamType(Type *Ty) const;
   Type *NormalizeType(Type *Ty) const;
 
   void EnumerateValue(const Value *V);