Update LocalSubtyping for exact references (#7355)

After calculating the best possible type for a local, LocalSubtyping
then checks to see whether the local can be non-nullable based on
whether all of its gets are dominated by sets. If it cannot be
non-nullable, the new type is adjusted to be nullable. This adjustment
did not previously preserve exactness, causing an assertion that the
optimization improves the type to fail. Fix the adjustment and add a
test.

Author: tlively

scripts/test/fuzzing.py

@@ -104,6 +104,7 @@
     # TODO: fuzzer support for exact references
     'exact-references.wast',
     'optimize-instructions-exact.wast',
+    'local-subtyping-exact.wast',
 ]
 
 

src/passes/LocalSubtyping.cpp

@@ -152,7 +152,8 @@ struct LocalSubtyping : public WalkerPass<PostWalker<LocalSubtyping>> {
         // Remove non-nullability if we disallow that in locals.
         if (newType.isNonNullable()) {
           if (cannotBeNonNullable.count(i)) {
-            newType = Type(newType.getHeapType(), Nullable);
+            newType =
+              Type(newType.getHeapType(), Nullable, newType.getExactness());
           }
         } else if (!newType.isDefaultable()) {
           // Aside from the case we just handled of allowed non-nullability, we

test/lit/passes/local-subtyping-exact.wast

@@ -0,0 +1,39 @@
+;; NOTE: Assertions have been generated by update_lit_checks.py and should not be edited.
+
+;; Check that LocalSubtyping handles exact references properly when it
+;; determines that a local that would otherwise be non-nullable must be nullable
+;; because of control flow dominance constraints.
+
+;; RUN: wasm-opt %s -all --local-subtyping -S -o - | filecheck %s
+
+(module
+ ;; CHECK:      (func $test (type $0) (param $0 (exact nullref)) (result anyref)
+ ;; CHECK-NEXT:  (local $1 (exact nullref))
+ ;; CHECK-NEXT:  (if
+ ;; CHECK-NEXT:   (i32.const 0)
+ ;; CHECK-NEXT:   (then
+ ;; CHECK-NEXT:    (local.set $1
+ ;; CHECK-NEXT:     (ref.as_non_null
+ ;; CHECK-NEXT:      (local.get $0)
+ ;; CHECK-NEXT:     )
+ ;; CHECK-NEXT:    )
+ ;; CHECK-NEXT:   )
+ ;; CHECK-NEXT:  )
+ ;; CHECK-NEXT:  (local.get $1)
+ ;; CHECK-NEXT: )
+ (func $test (param (exact nullref)) (result anyref)
+  (local (exact nullref))
+  (if
+   (i32.const 0)
+   (then
+    (local.set 1
+     ;; This would let the local be (ref exact none) if it dominated the get.
+     (ref.as_non_null
+      (local.get 0)
+     )
+    )
+   )
+  )
+  (local.get 1)
+ )
+)