Fix optimization of casts to exact null types (#7365)

The logic for optimizing ref.casts that are known to succeed did not
account for possible casts to exact null types, leading to it producing
invalid IR. Fix it and add a test.

Author: tlively

src/passes/OptimizeInstructions.cpp

@@ -2277,10 +2277,14 @@ struct OptimizeInstructions
           // emit a null check.
           bool needsNullCheck = ref->type.getNullability() == Nullable &&
                                 curr->type.getNullability() == NonNullable;
+          // Same with exactness.
+          bool needsExactCast = ref->type.getExactness() == Inexact &&
+                                curr->type.getExactness() == Exact;
           // If the best value to propagate is the argument to the cast, we can
           // simply remove the cast (or downgrade it to a null check if
-          // necessary).
-          if (ref == curr->ref) {
+          // necessary). This does not work if we need a cast to prove
+          // exactness.
+          if (ref == curr->ref && !needsExactCast) {
             if (needsNullCheck) {
               replaceCurrent(builder.makeRefAs(RefAsNonNull, curr->ref));
             } else {
@@ -2289,17 +2293,22 @@ struct OptimizeInstructions
             return;
           }
           // Otherwise we can't just remove the cast and replace it with `ref`
-          // because the intermediate expressions might have had side effects.
-          // We can replace the cast with a drop followed by a direct return of
-          // the value, though.
+          // because the intermediate expressions might have had side effects or
+          // we need to check exactness. We can replace the cast with a drop
+          // followed by a direct return of the value, though.
           if (ref->type.isNull()) {
+            // TODO: Remove this once we type ref.null as exact.
+            if (needsExactCast) {
+              return;
+            }
+
             // We can materialize the resulting null value directly.
             //
             // The type must be nullable for us to do that, which it normally
             // would be, aside from the interesting corner case of
             // uninhabitable types:
             //
-            //  (ref.cast func
+            //  (ref.cast (ref func)
             //    (block (result (ref nofunc))
             //      (unreachable)
             //    )

test/lit/passes/optimize-instructions-exact.wast

@@ -6,19 +6,27 @@
 ;; RUN: wasm-opt %s -all --optimize-instructions -S -o - | filecheck %s
 
 (module
- ;; CHECK:      (func $cast-to-exact-none (type $0) (param $0 anyref)
- ;; CHECK-NEXT:  (drop
- ;; CHECK-NEXT:   (ref.cast (exact nullref)
- ;; CHECK-NEXT:    (local.get $0)
- ;; CHECK-NEXT:   )
+ ;; CHECK:      (func $cast-any-to-exact-none (type $0) (param $0 anyref) (result (exact nullref))
+ ;; CHECK-NEXT:  (ref.cast (exact nullref)
+ ;; CHECK-NEXT:   (local.get $0)
  ;; CHECK-NEXT:  )
  ;; CHECK-NEXT: )
- (func $cast-to-exact-none (param anyref)
-  (drop
-   ;; This will not be changed, but should not trigger an assertion.
-   (ref.cast (exact nullref)
-    (local.get 0)
-   )
+ (func $cast-any-to-exact-none (param anyref) (result (exact nullref))
+  ;; This will not be changed, but should not trigger an assertion.
+  (ref.cast (exact nullref)
+   (local.get 0)
+  )
+ )
+ ;; CHECK:      (func $cast-null-to-exact-none (type $1) (result (exact nullref))
+ ;; CHECK-NEXT:  (local $0 nullref)
+ ;; CHECK-NEXT:  (ref.cast (exact nullref)
+ ;; CHECK-NEXT:   (local.get $0)
+ ;; CHECK-NEXT:  )
+ ;; CHECK-NEXT: )
+ (func $cast-null-to-exact-none (result (exact nullref))
+  (local nullref)
+  (ref.cast (exact nullref)
+   (local.get 0)
   )
  )
 )