Fix RefNull issues (#3123)

* ExpressionAnalyzer: Fix `ref.null ht` equality check to include `ht`.
* Precompute: Fix `ref.null ht` expression reuse to also update `ht`.
* Fuzzing: Fix `ref.null func` becoming canonicalized to `ref.func $funcref`
  when evaluating execution results, by adding a check for `isNull`.
* Fuzzing: Print actual and expected execution results when aborting.
* Tests: Update `if-arms-subtype` test in `optimize-instructions` to check
  that identical `if` arms become folded while not identical arms are kept.

5 files changed, 30 insertions, 10 deletions

diff --git a/src/ir/ExpressionAnalyzer.cpp b/src/ir/ExpressionAnalyzer.cpp
index cdbcd9ae0..d2f9611f9 100644
--- a/src/ir/ExpressionAnalyzer.cpp
+++ b/src/ir/ExpressionAnalyzer.cpp
@@ -219,7 +219,7 @@ template<typename T> void visitImmediates(Expression* curr, T& visitor) {
       visitor.visitInt(curr->op);
       visitor.visitNonScopeName(curr->nameOperand);
     }
-    void visitRefNull(RefNull* curr) {}
+    void visitRefNull(RefNull* curr) { visitor.visitType(curr->type); }
     void visitRefIsNull(RefIsNull* curr) {}
     void visitRefFunc(RefFunc* curr) { visitor.visitNonScopeName(curr->func); }
     void visitTry(Try* curr) {}
diff --git a/src/passes/Precompute.cpp b/src/passes/Precompute.cpp
index 0b67a25aa..d8a1fa9fc 100644
--- a/src/passes/Precompute.cpp
+++ b/src/passes/Precompute.cpp
@@ -134,9 +134,12 @@ struct Precompute
             curr->finalize();
             return;
           }
-        } else if (singleValue.isNull() &&
-                   curr->value->template is<RefNull>()) {
-          return;
+        } else if (singleValue.isNull()) {
+          if (auto* n = curr->value->template dynCast<RefNull>()) {
+            n->finalize(singleValue.type);
+            curr->finalize();
+            return;
+          }
         } else if (singleValue.type == Type::funcref) {
           if (auto* r = curr->value->template dynCast<RefFunc>()) {
             r->func = singleValue.getFunc();
diff --git a/src/tools/execution-results.h b/src/tools/execution-results.h
index c41b0c208..0881163f1 100644
--- a/src/tools/execution-results.h
+++ b/src/tools/execution-results.h
@@ -73,7 +73,7 @@ struct ExecutionResults {
           // change (after duplicate function elimination or roundtripping)
           // while the function contents are still the same
           for (Literal& val : ret) {
-            if (val.type == Type::funcref) {
+            if (val.type == Type::funcref && !val.isNull()) {
               val = Literal::makeFunc(Name("funcref"));
             }
           }
@@ -112,7 +112,8 @@ struct ExecutionResults {
       }
       std::cout << "[fuzz-exec] comparing " << name << '\n';
       if (results[name] != other.results[name]) {
-        std::cout << "not identical!\n";
+        std::cout << "not identical! " << results[name]
+                  << " != " << other.results[name] << "\n";
         return false;
       }
     }
diff --git a/test/passes/optimize-instructions_all-features.txt b/test/passes/optimize-instructions_all-features.txt
index f223cb838..31c1afbfc 100644
--- a/test/passes/optimize-instructions_all-features.txt
+++ b/test/passes/optimize-instructions_all-features.txt
@@ -10,11 +10,11 @@
  (type $i64_=>_i64 (func (param i64) (result i64)))
  (type $i32_i64_f32_=>_none (func (param i32 i64 f32)))
  (type $i32_i64_f32_f64_=>_none (func (param i32 i64 f32 f64)))
+ (type $none_=>_anyref (func (result anyref)))
  (type $i32_i32_i32_=>_none (func (param i32 i32 i32)))
  (type $i32_i32_f64_f64_=>_none (func (param i32 i32 f64 f64)))
  (type $i32_i64_f64_i32_=>_none (func (param i32 i64 f64 i32)))
  (type $none_=>_f64 (func (result f64)))
- (type $none_=>_anyref (func (result anyref)))
  (memory $0 0)
  (export "load-off-2" (func $load-off-2))
  (func $f (param $i1 i32) (param $i2 i64)
@@ -3712,9 +3712,16 @@
    (unreachable)
   )
  )
- (func $if-arms-subtype (result anyref)
+ (func $if-arms-subtype-fold (result anyref)
   (ref.null extern)
  )
+ (func $if-arms-subtype-nofold (result anyref)
+  (if (result anyref)
+   (i32.const 0)
+   (ref.null extern)
+   (ref.null func)
+  )
+ )
  (func $optimize-boolean-context (param $x i32) (param $y i32)
   (if
    (local.get $x)
diff --git a/test/passes/optimize-instructions_all-features.wast b/test/passes/optimize-instructions_all-features.wast
index 6e106ad1b..c2fa16e35 100644
--- a/test/passes/optimize-instructions_all-features.wast
+++ b/test/passes/optimize-instructions_all-features.wast
@@ -4207,8 +4207,17 @@
       (unreachable)
     )
   )
-  ;; Tests when if arms are subtype of if's type
-  (func $if-arms-subtype (result anyref)
+  ;; These functions test if an `if` with subtyped arms is correctly folded
+  ;; 1. if its `ifTrue` and `ifFalse` arms are identical (can fold)
+  (func $if-arms-subtype-fold (result anyref)
+    (if (result anyref)
+      (i32.const 0)
+      (ref.null extern)
+      (ref.null extern)
+    )
+  )
+  ;; 2. if its `ifTrue` and `ifFalse` arms are not identical (cannot fold)
+  (func $if-arms-subtype-nofold (result anyref)
     (if (result anyref)
       (i32.const 0)
       (ref.null extern)