Update RemoveUnusedBrs for exact references (#7360)

When optimizing branching casts, RemoveUnusedBrs previously assumed that
if a source reference type was not a subtype of another target reference
type, but the source's heap type was a subtype of the target's heap
type, then it could use ref.as_non_null to convert from the source to
the target. This is no longer true now that we have exact types because
the types may differ in their exactness rather than in their nullness.

Update the check guarding the use of ref.as_non_null to specifically
check that a non-nullable version of the source type is a subtype of the
destination type and add a test.

Author: tlively

scripts/test/fuzzing.py

@@ -107,6 +107,7 @@
     'local-subtyping-exact.wast',
     'remove-unused-types-exact.wast',
     'coalesce-locals-exact.wast',
+    'remove-unused-brs-exact.wast',
 ]
 
 

src/passes/RemoveUnusedBrs.cpp

@@ -859,8 +859,8 @@ struct RemoveUnusedBrs : public WalkerPass<PostWalker<RemoveUnusedBrs>> {
           if (Type::isSubType(expr->type, type)) {
             return expr;
           }
-          if (HeapType::isSubType(expr->type.getHeapType(),
-                                  type.getHeapType())) {
+          if (type.isNonNullable() && expr->type.isNullable() &&
+              Type::isSubType(expr->type.with(NonNullable), type)) {
             return builder.makeRefAs(RefAsNonNull, expr);
           }
           return builder.makeRefCast(expr, type);

test/lit/passes/remove-unused-brs-exact.wast

@@ -0,0 +1,40 @@
+;; NOTE: Assertions have been generated by update_lit_checks.py and should not be edited.
+
+;; RUN: wasm-opt %s -all --remove-unused-brs -S -o - | filecheck %s
+
+;; Check that we optimize the cast correctly when the fallthrough has exact
+;; type. In particular, we should not insert a ref.as_non_null, which would
+;; trap.
+
+(module
+ ;; CHECK:      (func $br_on_cast_fail (type $0) (param $0 (exact nullref))
+ ;; CHECK-NEXT:  (local $1 nullref)
+ ;; CHECK-NEXT:  (drop
+ ;; CHECK-NEXT:   (block $block
+ ;; CHECK-NEXT:    (drop
+ ;; CHECK-NEXT:     (ref.cast (exact nullref)
+ ;; CHECK-NEXT:      (local.tee $1
+ ;; CHECK-NEXT:       (local.get $0)
+ ;; CHECK-NEXT:      )
+ ;; CHECK-NEXT:     )
+ ;; CHECK-NEXT:    )
+ ;; CHECK-NEXT:    (return)
+ ;; CHECK-NEXT:   )
+ ;; CHECK-NEXT:  )
+ ;; CHECK-NEXT: )
+ (func $br_on_cast_fail (param (ref null exact none))
+  (local $1 nullref)
+  (drop
+   (block $block (result (ref none))
+    (drop
+     (br_on_cast_fail $block nullref nullref
+      (local.tee $1
+       (local.get 0)
+      )
+     )
+    )
+    (return)
+   )
+  )
+ )
+)