[Wasm GC] Add static variants of ref.test, ref.cast, and br_on_cast* (#4163)

These variants take a HeapType that is the type we intend to cast to,
and do not take an RTT.

These are intended to be more statically optimizable. For now though
this PR just implements the minimum to get them parsing and to get
through the optimizer without crashing.

Spec: https://docs.google.com/document/d/1afthjsL_B9UaMqCA5ekgVmOm75BVFu6duHNsN9-gnXw/edit#

See #4149

23 files changed, 791 insertions, 176 deletions

diff --git a/scripts/gen-s-parser.py b/scripts/gen-s-parser.py
index 50ffdb301..556f537e7 100755
--- a/scripts/gen-s-parser.py
+++ b/scripts/gen-s-parser.py
@@ -537,11 +537,15 @@ instructions = [
     ("i31.get_s",            "makeI31Get(s, true)"),
     ("i31.get_u",            "makeI31Get(s, false)"),
     ("ref.test",             "makeRefTest(s)"),
+    ("ref.test_static",      "makeRefTestStatic(s)"),
     ("ref.cast",             "makeRefCast(s)"),
+    ("ref.cast_static",      "makeRefCastStatic(s)"),
     ("br_on_null",           "makeBrOn(s, BrOnNull)"),
     ("br_on_non_null",       "makeBrOn(s, BrOnNonNull)"),
     ("br_on_cast",           "makeBrOn(s, BrOnCast)"),
+    ("br_on_cast_static",    "makeBrOnStatic(s, BrOnCast)"),
     ("br_on_cast_fail",      "makeBrOn(s, BrOnCastFail)"),
+    ("br_on_cast_static_fail", "makeBrOnStatic(s, BrOnCastFail)"),
     ("br_on_func",           "makeBrOn(s, BrOnFunc)"),
     ("br_on_non_func",       "makeBrOn(s, BrOnNonFunc)"),
     ("br_on_data",           "makeBrOn(s, BrOnData)"),
diff --git a/src/gen-s-parser.inc b/src/gen-s-parser.inc
index 7374e630a..c7c521a21 100644
--- a/src/gen-s-parser.inc
+++ b/src/gen-s-parser.inc
@@ -84,9 +84,25 @@ switch (op[0]) {
                       case '\0':
                         if (strcmp(op, "br_on_cast") == 0) { return makeBrOn(s, BrOnCast); }
                         goto parse_error;
-                      case '_':
-                        if (strcmp(op, "br_on_cast_fail") == 0) { return makeBrOn(s, BrOnCastFail); }
-                        goto parse_error;
+                      case '_': {
+                        switch (op[11]) {
+                          case 'f':
+                            if (strcmp(op, "br_on_cast_fail") == 0) { return makeBrOn(s, BrOnCastFail); }
+                            goto parse_error;
+                          case 's': {
+                            switch (op[17]) {
+                              case '\0':
+                                if (strcmp(op, "br_on_cast_static") == 0) { return makeBrOnStatic(s, BrOnCast); }
+                                goto parse_error;
+                              case '_':
+                                if (strcmp(op, "br_on_cast_static_fail") == 0) { return makeBrOnStatic(s, BrOnCastFail); }
+                                goto parse_error;
+                              default: goto parse_error;
+                            }
+                          }
+                          default: goto parse_error;
+                        }
+                      }
                       default: goto parse_error;
                     }
                   }
@@ -2831,9 +2847,17 @@ switch (op[0]) {
                   default: goto parse_error;
                 }
               }
-              case 'c':
-                if (strcmp(op, "ref.cast") == 0) { return makeRefCast(s); }
-                goto parse_error;
+              case 'c': {
+                switch (op[8]) {
+                  case '\0':
+                    if (strcmp(op, "ref.cast") == 0) { return makeRefCast(s); }
+                    goto parse_error;
+                  case '_':
+                    if (strcmp(op, "ref.cast_static") == 0) { return makeRefCastStatic(s); }
+                    goto parse_error;
+                  default: goto parse_error;
+                }
+              }
               case 'e':
                 if (strcmp(op, "ref.eq") == 0) { return makeRefEq(s); }
                 goto parse_error;
@@ -2860,9 +2884,17 @@ switch (op[0]) {
               case 'n':
                 if (strcmp(op, "ref.null") == 0) { return makeRefNull(s); }
                 goto parse_error;
-              case 't':
-                if (strcmp(op, "ref.test") == 0) { return makeRefTest(s); }
-                goto parse_error;
+              case 't': {
+                switch (op[8]) {
+                  case '\0':
+                    if (strcmp(op, "ref.test") == 0) { return makeRefTest(s); }
+                    goto parse_error;
+                  case '_':
+                    if (strcmp(op, "ref.test_static") == 0) { return makeRefTestStatic(s); }
+                    goto parse_error;
+                  default: goto parse_error;
+                }
+              }
               default: goto parse_error;
             }
           }
diff --git a/src/ir/cost.h b/src/ir/cost.h
index e3e6aebf3..086b7b9af 100644
--- a/src/ir/cost.h
+++ b/src/ir/cost.h
@@ -567,15 +567,17 @@ struct CostAnalyzer : public OverriddenVisitor<CostAnalyzer, CostType> {
   CostType visitI31New(I31New* curr) { return 3 + visit(curr->value); }
   CostType visitI31Get(I31Get* curr) { return 2 + visit(curr->i31); }
   CostType visitRefTest(RefTest* curr) {
-    return 2 + nullCheckCost(curr->ref) + visit(curr->ref) + visit(curr->rtt);
+    return 2 + nullCheckCost(curr->ref) + visit(curr->ref) +
+           maybeVisit(curr->rtt);
   }
   CostType visitRefCast(RefCast* curr) {
-    return 2 + nullCheckCost(curr->ref) + visit(curr->ref) + visit(curr->rtt);
+    return 2 + nullCheckCost(curr->ref) + visit(curr->ref) +
+           maybeVisit(curr->rtt);
   }
   CostType visitBrOn(BrOn* curr) {
     // BrOnCast has more work to do with the rtt, so add a little there.
     CostType base = curr->op == BrOnCast ? 3 : 2;
-    return base + nullCheckCost(curr->ref) + visit(curr->ref) +
+    return base + nullCheckCost(curr->ref) + maybeVisit(curr->ref) +
            maybeVisit(curr->rtt);
   }
   CostType visitRttCanon(RttCanon* curr) {
diff --git a/src/passes/OptimizeInstructions.cpp b/src/passes/OptimizeInstructions.cpp
index b9b426466..cc263d228 100644
--- a/src/passes/OptimizeInstructions.cpp
+++ b/src/passes/OptimizeInstructions.cpp
@@ -1341,96 +1341,103 @@ struct OptimizeInstructions
     Builder builder(*getModule());
     auto passOptions = getPassOptions();
 
-    auto fallthrough =
-      Properties::getFallthrough(curr->ref, getPassOptions(), *getModule());
-
-    // If the value is a null, it will just flow through, and we do not need the
-    // cast. However, if that would change the type, then things are less
-    // simple: if the original type was non-nullable, replacing it with a null
-    // would change the type, which can happen in e.g.
-    //   (ref.cast (ref.as_non_null (.. (ref.null)
-    if (fallthrough->is<RefNull>()) {
-      // Replace the expression with drops of the inputs, and a null. Note that
-      // we provide a null of the type the outside expects - that of the rtt,
-      // which is what was cast to.
-      Expression* rep =
-        builder.makeBlock({builder.makeDrop(curr->ref),
-                           builder.makeDrop(curr->rtt),
-                           builder.makeRefNull(curr->rtt->type.getHeapType())});
-      if (curr->ref->type.isNonNullable()) {
-        // Avoid a type change by forcing to be non-nullable. In practice, this
-        // would have trapped before we get here, so this is just for
-        // validation.
-        rep = builder.makeRefAs(RefAsNonNull, rep);
-      }
-      replaceCurrent(rep);
-      return;
-      // TODO: The optimal ordering of this and the other ref.as_non_null stuff
-      //       later down in this functions is unclear and may be worth looking
-      //       into.
-    }
-
-    // For the cast to be able to succeed, the value being cast must be a
-    // subtype of the desired type, as RTT subtyping is a subset of static
-    // subtyping. For example, trying to cast an array to a struct would be
-    // incompatible.
-    if (!canBeCastTo(curr->ref->type.getHeapType(),
-                     curr->rtt->type.getHeapType())) {
-      // This cast cannot succeed. If the input is not a null, it will
-      // definitely trap.
-      if (fallthrough->type.isNonNullable()) {
-        // Our type will now be unreachable; update the parents.
-        refinalize = true;
-        replaceCurrent(builder.makeBlock({builder.makeDrop(curr->ref),
-                                          builder.makeDrop(curr->rtt),
-                                          builder.makeUnreachable()}));
-        return;
-      }
-      // Otherwise, we are not sure what it is, and need to wait for runtime to
-      // see if it is a null or not. (We've already handled the case where we
-      // can see the value is definitely a null at compile time, earlier.)
-    }
-
-    if (passOptions.ignoreImplicitTraps || passOptions.trapsNeverHappen) {
-      // Aside from the issue of type incompatibility as mentioned above, the
-      // cast can trap if the types *are* compatible but it happens to be the
-      // case at runtime that the value is not of the desired subtype. If we
-      // do not consider such traps possible, we can ignore that. Note, though,
-      // that we cannot do this if we cannot replace the current type with the
-      // reference's type.
-      if (HeapType::isSubType(curr->ref->type.getHeapType(),
-                              curr->rtt->type.getHeapType())) {
-        replaceCurrent(getResultOfFirst(curr->ref,
-                                        builder.makeDrop(curr->rtt),
-                                        getFunction(),
-                                        getModule(),
-                                        passOptions));
+    // TODO: If no rtt, this is a static cast, and if the type matches then it
+    //       will definitely succeed. The opts below could be expanded for that.
+    if (curr->rtt) {
+
+      auto fallthrough =
+        Properties::getFallthrough(curr->ref, getPassOptions(), *getModule());
+
+      // If the value is a null, it will just flow through, and we do not need
+      // the cast. However, if that would change the type, then things are less
+      // simple: if the original type was non-nullable, replacing it with a null
+      // would change the type, which can happen in e.g.
+      //   (ref.cast (ref.as_non_null (.. (ref.null)
+      if (fallthrough->is<RefNull>()) {
+        // Replace the expression with drops of the inputs, and a null. Note
+        // that we provide a null of the type the outside expects - that of the
+        // rtt, which is what was cast to.
+        Expression* rep = builder.makeBlock(
+          {builder.makeDrop(curr->ref),
+           builder.makeDrop(curr->rtt),
+           builder.makeRefNull(curr->rtt->type.getHeapType())});
+        if (curr->ref->type.isNonNullable()) {
+          // Avoid a type change by forcing to be non-nullable. In practice,
+          // this would have trapped before we get here, so this is just for
+          // validation.
+          rep = builder.makeRefAs(RefAsNonNull, rep);
+        }
+        replaceCurrent(rep);
         return;
+        // TODO: The optimal ordering of this and the other ref.as_non_null
+        //       stuff later down in this functions is unclear and may be worth
+        //       looking into.
+      }
+
+      // For the cast to be able to succeed, the value being cast must be a
+      // subtype of the desired type, as RTT subtyping is a subset of static
+      // subtyping. For example, trying to cast an array to a struct would be
+      // incompatible.
+      if (!canBeCastTo(curr->ref->type.getHeapType(),
+                       curr->rtt->type.getHeapType())) {
+        // This cast cannot succeed. If the input is not a null, it will
+        // definitely trap.
+        if (fallthrough->type.isNonNullable()) {
+          // Our type will now be unreachable; update the parents.
+          refinalize = true;
+          replaceCurrent(builder.makeBlock({builder.makeDrop(curr->ref),
+                                            builder.makeDrop(curr->rtt),
+                                            builder.makeUnreachable()}));
+          return;
+        }
+        // Otherwise, we are not sure what it is, and need to wait for runtime
+        // to see if it is a null or not. (We've already handled the case where
+        // we can see the value is definitely a null at compile time, earlier.)
+      }
+
+      if (passOptions.ignoreImplicitTraps || passOptions.trapsNeverHappen) {
+        // Aside from the issue of type incompatibility as mentioned above, the
+        // cast can trap if the types *are* compatible but it happens to be the
+        // case at runtime that the value is not of the desired subtype. If we
+        // do not consider such traps possible, we can ignore that. Note,
+        // though, that we cannot do this if we cannot replace the current type
+        // with the reference's type.
+        if (HeapType::isSubType(curr->ref->type.getHeapType(),
+                                curr->rtt->type.getHeapType())) {
+          replaceCurrent(getResultOfFirst(curr->ref,
+                                          builder.makeDrop(curr->rtt),
+                                          getFunction(),
+                                          getModule(),
+                                          passOptions));
+          return;
+        }
       }
-    }
 
-    // Repeated identical ref.cast operations are unnecessary, if using the
-    // exact same rtt - the result will be the same. Find the immediate child
-    // cast, if there is one, and see if it is identical.
-    // TODO: Look even further through incompatible casts?
-    auto* ref = curr->ref;
-    while (!ref->is<RefCast>()) {
-      auto* last = ref;
-      // RefCast falls through the value, so instead of calling getFallthrough()
-      // to look through all fallthroughs, we must iterate manually. Keep going
-      // until we reach either the end of things falling-through, or a cast.
-      ref = Properties::getImmediateFallthrough(ref, passOptions, *getModule());
-      if (ref == last) {
-        break;
+      // Repeated identical ref.cast operations are unnecessary, if using the
+      // exact same rtt - the result will be the same. Find the immediate child
+      // cast, if there is one, and see if it is identical.
+      // TODO: Look even further through incompatible casts?
+      auto* ref = curr->ref;
+      while (!ref->is<RefCast>()) {
+        auto* last = ref;
+        // RefCast falls through the value, so instead of calling
+        // getFallthrough() to look through all fallthroughs, we must iterate
+        // manually. Keep going until we reach either the end of things
+        // falling-through, or a cast.
+        ref =
+          Properties::getImmediateFallthrough(ref, passOptions, *getModule());
+        if (ref == last) {
+          break;
+        }
       }
-    }
-    if (auto* child = ref->dynCast<RefCast>()) {
-      // Check if the casts are identical.
-      if (ExpressionAnalyzer::equal(curr->rtt, child->rtt) &&
-          !EffectAnalyzer(passOptions, *getModule(), curr->rtt)
-             .hasSideEffects()) {
-        replaceCurrent(curr->ref);
-        return;
+      if (auto* child = ref->dynCast<RefCast>()) {
+        // Check if the casts are identical.
+        if (ExpressionAnalyzer::equal(curr->rtt, child->rtt) &&
+            !EffectAnalyzer(passOptions, *getModule(), curr->rtt)
+               .hasSideEffects()) {
+          replaceCurrent(curr->ref);
+          return;
+        }
       }
     }
 
@@ -1469,14 +1476,18 @@ struct OptimizeInstructions
       return;
     }
 
-    // See above in RefCast.
-    if (!canBeCastTo(curr->ref->type.getHeapType(),
-                     curr->rtt->type.getHeapType())) {
-      // This test cannot succeed, and will definitely return 0.
-      Builder builder(*getModule());
-      replaceCurrent(builder.makeBlock({builder.makeDrop(curr->ref),
-                                        builder.makeDrop(curr->rtt),
-                                        builder.makeConst(int32_t(0))}));
+    // TODO: If no rtt, this is a static test, and if the type matches then it
+    //       will definitely succeed. The opt below could be expanded for that.
+    if (curr->rtt) {
+      // See above in RefCast.
+      if (!canBeCastTo(curr->ref->type.getHeapType(),
+                       curr->rtt->type.getHeapType())) {
+        // This test cannot succeed, and will definitely return 0.
+        Builder builder(*getModule());
+        replaceCurrent(builder.makeBlock({builder.makeDrop(curr->ref),
+                                          builder.makeDrop(curr->rtt),
+                                          builder.makeConst(int32_t(0))}));
+      }
     }
   }
 
diff --git a/src/passes/Print.cpp b/src/passes/Print.cpp
index 00b09dea4..6198218d8 100644
--- a/src/passes/Print.cpp
+++ b/src/passes/Print.cpp
@@ -286,6 +286,12 @@ static std::ostream& printType(std::ostream& o, Type type, Module* wasm) {
   return o;
 }
 
+static std::ostream&
+printHeapType(std::ostream& o, HeapType type, Module* wasm) {
+  TypeNamePrinter(o, wasm).print(type);
+  return o;
+}
+
 static std::ostream& printPrefixedTypes(std::ostream& o,
                                         const char* prefix,
                                         Type type,
@@ -1811,7 +1817,7 @@ struct PrintExpressionContents
   void visitMemoryGrow(MemoryGrow* curr) { printMedium(o, "memory.grow"); }
   void visitRefNull(RefNull* curr) {
     printMedium(o, "ref.null ");
-    TypeNamePrinter(o, wasm).print(curr->type.getHeapType());
+    printHeapType(o, curr->type.getHeapType(), wasm);
   }
   void visitRefIs(RefIs* curr) {
     switch (curr->op) {
@@ -1881,8 +1887,22 @@ struct PrintExpressionContents
       printMedium(o, "call_ref");
     }
   }
-  void visitRefTest(RefTest* curr) { printMedium(o, "ref.test"); }
-  void visitRefCast(RefCast* curr) { printMedium(o, "ref.cast"); }
+  void visitRefTest(RefTest* curr) {
+    if (curr->rtt) {
+      printMedium(o, "ref.test");
+    } else {
+      printMedium(o, "ref.test_static ");
+      printHeapType(o, curr->intendedType, wasm);
+    }
+  }
+  void visitRefCast(RefCast* curr) {
+    if (curr->rtt) {
+      printMedium(o, "ref.cast");
+    } else {
+      printMedium(o, "ref.cast_static ");
+      printHeapType(o, curr->intendedType, wasm);
+    }
+  }
   void visitBrOn(BrOn* curr) {
     switch (curr->op) {
       case BrOnNull:
@@ -1892,10 +1912,26 @@ struct PrintExpressionContents
         printMedium(o, "br_on_non_null ");
         break;
       case BrOnCast:
-        printMedium(o, "br_on_cast ");
+        if (curr->rtt) {
+          printMedium(o, "br_on_cast ");
+        } else {
+          printMedium(o, "br_on_cast_static ");
+          printName(curr->name, o);
+          o << ' ';
+          printHeapType(o, curr->intendedType, wasm);
+          return;
+        }
         break;
       case BrOnCastFail:
-        printMedium(o, "br_on_cast_fail ");
+        if (curr->rtt) {
+          printMedium(o, "br_on_cast_fail ");
+        } else {
+          printMedium(o, "br_on_cast_static_fail ");
+          printName(curr->name, o);
+          o << ' ';
+          printHeapType(o, curr->intendedType, wasm);
+          return;
+        }
         break;
       case BrOnFunc:
         printMedium(o, "br_on_func ");
diff --git a/src/wasm-binary.h b/src/wasm-binary.h
index d8d712f62..0e4b4b873 100644
--- a/src/wasm-binary.h
+++ b/src/wasm-binary.h
@@ -1071,6 +1071,10 @@ enum ASTNodes {
   RefCast = 0x41,
   BrOnCast = 0x42,
   BrOnCastFail = 0x43,
+  RefTestStatic = 0x44,
+  RefCastStatic = 0x45,
+  BrOnCastStatic = 0x46,
+  BrOnCastStaticFail = 0x47,
   RefIsFunc = 0x50,
   RefIsData = 0x51,
   RefIsI31 = 0x52,
diff --git a/src/wasm-builder.h b/src/wasm-builder.h
index 018b0bf8b..346f2f5ba 100644
--- a/src/wasm-builder.h
+++ b/src/wasm-builder.h
@@ -765,6 +765,13 @@ public:
     ret->finalize();
     return ret;
   }
+  RefTest* makeRefTest(Expression* ref, HeapType intendedType) {
+    auto* ret = wasm.allocator.alloc<RefTest>();
+    ret->ref = ref;
+    ret->intendedType = intendedType;
+    ret->finalize();
+    return ret;
+  }
   RefCast* makeRefCast(Expression* ref, Expression* rtt) {
     auto* ret = wasm.allocator.alloc<RefCast>();
     ret->ref = ref;
@@ -772,6 +779,13 @@ public:
     ret->finalize();
     return ret;
   }
+  RefCast* makeRefCast(Expression* ref, HeapType intendedType) {
+    auto* ret = wasm.allocator.alloc<RefCast>();
+    ret->ref = ref;
+    ret->intendedType = intendedType;
+    ret->finalize();
+    return ret;
+  }
   BrOn*
   makeBrOn(BrOnOp op, Name name, Expression* ref, Expression* rtt = nullptr) {
     auto* ret = wasm.allocator.alloc<BrOn>();
@@ -782,6 +796,15 @@ public:
     ret->finalize();
     return ret;
   }
+  BrOn* makeBrOn(BrOnOp op, Name name, Expression* ref, HeapType intendedType) {
+    auto* ret = wasm.allocator.alloc<BrOn>();
+    ret->op = op;
+    ret->name = name;
+    ret->ref = ref;
+    ret->intendedType = intendedType;
+    ret->finalize();
+    return ret;
+  }
   RttCanon* makeRttCanon(HeapType heapType) {
     auto* ret = wasm.allocator.alloc<RttCanon>();
     ret->type = Type(Rtt(0, heapType));
diff --git a/src/wasm-delegations-fields.def b/src/wasm-delegations-fields.def
index b94aa5599..6bbb7abaa 100644
--- a/src/wasm-delegations-fields.def
+++ b/src/wasm-delegations-fields.def
@@ -76,6 +76,8 @@
 //
 // DELEGATE_FIELD_TYPE(id, name) - called for a Type.
 //
+// DELEGATE_FIELD_HEAPTYPE(id, name) - called for a HeapType.
+//
 // DELEGATE_FIELD_ADDRESS(id, name) - called for an Address.
 
 #ifndef DELEGATE_START
@@ -166,6 +168,10 @@
 #error please define DELEGATE_FIELD_TYPE(id, name)
 #endif
 
+#ifndef DELEGATE_FIELD_HEAPTYPE
+#error please define DELEGATE_FIELD_HEAPTYPE(id, name)
+#endif
+
 #ifndef DELEGATE_FIELD_ADDRESS
 #error please define DELEGATE_FIELD_ADDRESS(id, name)
 #endif
@@ -570,14 +576,16 @@ switch (DELEGATE_ID) {
   }
   case Expression::Id::RefTestId: {
     DELEGATE_START(RefTest);
-    DELEGATE_FIELD_CHILD(RefTest, rtt);
+    DELEGATE_FIELD_HEAPTYPE(RefTest, intendedType);
+    DELEGATE_FIELD_OPTIONAL_CHILD(RefTest, rtt);
     DELEGATE_FIELD_CHILD(RefTest, ref);
     DELEGATE_END(RefTest);
     break;
   }
   case Expression::Id::RefCastId: {
     DELEGATE_START(RefCast);
-    DELEGATE_FIELD_CHILD(RefCast, rtt);
+    DELEGATE_FIELD_HEAPTYPE(RefCast, intendedType);
+    DELEGATE_FIELD_OPTIONAL_CHILD(RefCast, rtt);
     DELEGATE_FIELD_CHILD(RefCast, ref);
     DELEGATE_END(RefCast);
     break;
@@ -586,6 +594,7 @@ switch (DELEGATE_ID) {
     DELEGATE_START(BrOn);
     DELEGATE_FIELD_INT(BrOn, op);
     DELEGATE_FIELD_SCOPE_NAME_USE(BrOn, name);
+    DELEGATE_FIELD_HEAPTYPE(BrOn, intendedType);
     DELEGATE_FIELD_OPTIONAL_CHILD(BrOn, rtt);
     DELEGATE_FIELD_CHILD(BrOn, ref);
     DELEGATE_END(BrOn);
diff --git a/src/wasm-interpreter.h b/src/wasm-interpreter.h
index ca456406f..53d3048b7 100644
--- a/src/wasm-interpreter.h
+++ b/src/wasm-interpreter.h
@@ -1424,11 +1424,16 @@ public:
       cast.breaking = ref;
       return cast;
     }
-    Flow rtt = this->visit(curr->rtt);
-    if (rtt.breaking()) {
-      cast.outcome = cast.Break;
-      cast.breaking = rtt;
-      return cast;
+    Literal intendedRtt;
+    if (curr->rtt) {
+      // This is a dynamic check with an rtt.
+      Flow rtt = this->visit(curr->rtt);
+      if (rtt.breaking()) {
+        cast.outcome = cast.Break;
+        cast.breaking = rtt;
+        return cast;
+      }
+      intendedRtt = rtt.getSingleValue();
     }
     cast.originalRef = ref.getSingleValue();
     if (cast.originalRef.isNull()) {
@@ -1443,8 +1448,6 @@ public:
       cast.outcome = cast.Failure;
       return cast;
     }
-    Literal seenRtt;
-    Literal intendedRtt = rtt.getSingleValue();
     if (cast.originalRef.isFunction()) {
       // Function casts are simple in that they have no RTT hierarchies; instead
       // each reference has the canonical RTT for the signature.
@@ -1460,24 +1463,42 @@ public:
         cast.breaking = NONCONSTANT_FLOW;
         return cast;
       }
-      seenRtt = Literal(Type(Rtt(0, func->type)));
-      if (!seenRtt.isSubRtt(intendedRtt)) {
-        cast.outcome = cast.Failure;
-        return cast;
+      if (curr->rtt) {
+        Literal seenRtt = Literal(Type(Rtt(0, func->type)));
+        if (!seenRtt.isSubRtt(intendedRtt)) {
+          cast.outcome = cast.Failure;
+          return cast;
+        }
+        cast.castRef = Literal(
+          func->name, Type(intendedRtt.type.getHeapType(), NonNullable));
+      } else {
+        if (!HeapType::isSubType(func->type, curr->intendedType)) {
+          cast.outcome = cast.Failure;
+          return cast;
+        }
+        cast.castRef =
+          Literal(func->name, Type(curr->intendedType, NonNullable));
       }
-      cast.castRef =
-        Literal(func->name, Type(intendedRtt.type.getHeapType(), NonNullable));
     } else {
       // GC data store an RTT in each instance.
       assert(cast.originalRef.isData());
       auto gcData = cast.originalRef.getGCData();
-      seenRtt = gcData->rtt;
-      if (!seenRtt.isSubRtt(intendedRtt)) {
-        cast.outcome = cast.Failure;
-        return cast;
+      Literal seenRtt = gcData->rtt;
+      if (curr->rtt) {
+        if (!seenRtt.isSubRtt(intendedRtt)) {
+          cast.outcome = cast.Failure;
+          return cast;
+        }
+        cast.castRef =
+          Literal(gcData, Type(intendedRtt.type.getHeapType(), NonNullable));
+      } else {
+        auto seenType = seenRtt.type.getHeapType();
+        if (!HeapType::isSubType(seenType, curr->intendedType)) {
+          cast.outcome = cast.Failure;
+          return cast;
+        }
+        cast.castRef = Literal(gcData, Type(seenType, NonNullable));
       }
-      cast.castRef =
-        Literal(gcData, Type(intendedRtt.type.getHeapType(), NonNullable));
     }
     cast.outcome = cast.Success;
     return cast;
diff --git a/src/wasm-s-parser.h b/src/wasm-s-parser.h
index 03462a7cb..8348d3e6b 100644
--- a/src/wasm-s-parser.h
+++ b/src/wasm-s-parser.h
@@ -274,8 +274,11 @@ private:
   Expression* makeI31New(Element& s);
   Expression* makeI31Get(Element& s, bool signed_);
   Expression* makeRefTest(Element& s);
+  Expression* makeRefTestStatic(Element& s);
   Expression* makeRefCast(Element& s);
+  Expression* makeRefCastStatic(Element& s);
   Expression* makeBrOn(Element& s, BrOnOp op);
+  Expression* makeBrOnStatic(Element& s, BrOnOp op);
   Expression* makeRttCanon(Element& s);
   Expression* makeRttSub(Element& s);
   Expression* makeRttFreshSub(Element& s);
diff --git a/src/wasm-traversal.h b/src/wasm-traversal.h
index d3e2a19da..47e99226d 100644
--- a/src/wasm-traversal.h
+++ b/src/wasm-traversal.h
@@ -373,6 +373,7 @@ struct PostWalker : public Walker<SubType, VisitorType> {
 #define DELEGATE_FIELD_SCOPE_NAME_USE_VECTOR(id, name)
 #define DELEGATE_FIELD_SIGNATURE(id, name)
 #define DELEGATE_FIELD_TYPE(id, name)
+#define DELEGATE_FIELD_HEAPTYPE(id, name)
 #define DELEGATE_FIELD_ADDRESS(id, name)
 
 #include "wasm-delegations-fields.def"
diff --git a/src/wasm.h b/src/wasm.h
index d0d904b7c..ffc97f71e 100644
--- a/src/wasm.h
+++ b/src/wasm.h
@@ -1356,9 +1356,17 @@ public:
   RefTest(MixedArena& allocator) {}
 
   Expression* ref;
-  Expression* rtt;
+
+  // If rtt is provided then this is a dynamic test with an rtt. If nullptr then
+  // this is a static cast and intendedType is set, and it contains the type we
+  // intend to cast to.
+  Expression* rtt = nullptr;
+  HeapType intendedType;
 
   void finalize();
+
+  // Returns the type we intend to cast to.
+  HeapType getIntendedType();
 };
 
 class RefCast : public SpecificExpression<Expression::RefCastId> {
@@ -1366,9 +1374,15 @@ public:
   RefCast(MixedArena& allocator) {}
 
   Expression* ref;
-  Expression* rtt;
+
+  // See above with RefTest.
+  Expression* rtt = nullptr;
+  HeapType intendedType;
 
   void finalize();
+
+  // Returns the type we intend to cast to.
+  HeapType getIntendedType();
 };
 
 class BrOn : public SpecificExpression<Expression::BrOnId> {
@@ -1379,8 +1393,10 @@ public:
   Name name;
   Expression* ref;
 
-  // BrOnCast* has an rtt that is used in the cast.
-  Expression* rtt;
+  // BrOnCast* has, like RefCast and RefTest, either an rtt or a static intended
+  // type.
+  Expression* rtt = nullptr;
+  HeapType intendedType;
 
   // TODO: BrOnNull also has an optional extra value in the spec, which we do
   //       not support. See also the discussion on
@@ -1390,6 +1406,9 @@ public:
 
   void finalize();
 
+  // Returns the type we intend to cast to. Relevant only for the cast variants.
+  HeapType getIntendedType();
+
   // Returns the type sent on the branch, if it is taken.
   Type getSentType();
 };
diff --git a/src/wasm/wasm-binary.cpp b/src/wasm/wasm-binary.cpp
index dad6f9320..e1ff43988 100644
--- a/src/wasm/wasm-binary.cpp
+++ b/src/wasm/wasm-binary.cpp
@@ -6419,23 +6419,33 @@ bool WasmBinaryBuilder::maybeVisitI31Get(Expression*& out, uint32_t code) {
 }
 
 bool WasmBinaryBuilder::maybeVisitRefTest(Expression*& out, uint32_t code) {
-  if (code != BinaryConsts::RefTest) {
-    return false;
+  if (code == BinaryConsts::RefTest) {
+    auto* rtt = popNonVoidExpression();
+    auto* ref = popNonVoidExpression();
+    out = Builder(wasm).makeRefTest(ref, rtt);
+    return true;
+  } else if (code == BinaryConsts::RefTestStatic) {
+    auto intendedType = getIndexedHeapType();
+    auto* ref = popNonVoidExpression();
+    out = Builder(wasm).makeRefTest(ref, intendedType);
+    return true;
   }
-  auto* rtt = popNonVoidExpression();
-  auto* ref = popNonVoidExpression();
-  out = Builder(wasm).makeRefTest(ref, rtt);
-  return true;
+  return false;
 }
 
 bool WasmBinaryBuilder::maybeVisitRefCast(Expression*& out, uint32_t code) {
-  if (code != BinaryConsts::RefCast) {
-    return false;
+  if (code == BinaryConsts::RefCast) {
+    auto* rtt = popNonVoidExpression();
+    auto* ref = popNonVoidExpression();
+    out = Builder(wasm).makeRefCast(ref, rtt);
+    return true;
+  } else if (code == BinaryConsts::RefCastStatic) {
+    auto intendedType = getIndexedHeapType();
+    auto* ref = popNonVoidExpression();
+    out = Builder(wasm).makeRefCast(ref, intendedType);
+    return true;
   }
-  auto* rtt = popNonVoidExpression();
-  auto* ref = popNonVoidExpression();
-  out = Builder(wasm).makeRefCast(ref, rtt);
-  return true;
+  return false;
 }
 
 bool WasmBinaryBuilder::maybeVisitBrOn(Expression*& out, uint32_t code) {
@@ -6448,9 +6458,11 @@ bool WasmBinaryBuilder::maybeVisitBrOn(Expression*& out, uint32_t code) {
       op = BrOnNonNull;
       break;
     case BinaryConsts::BrOnCast:
+    case BinaryConsts::BrOnCastStatic:
       op = BrOnCast;
       break;
     case BinaryConsts::BrOnCastFail:
+    case BinaryConsts::BrOnCastStaticFail:
       op = BrOnCastFail;
       break;
     case BinaryConsts::BrOnFunc:
@@ -6475,6 +6487,13 @@ bool WasmBinaryBuilder::maybeVisitBrOn(Expression*& out, uint32_t code) {
       return false;
   }
   auto name = getBreakTarget(getU32LEB()).name;
+  if (code == BinaryConsts::BrOnCastStatic ||
+      code == BinaryConsts::BrOnCastStaticFail) {
+    auto intendedType = getIndexedHeapType();
+    auto* ref = popNonVoidExpression();
+    out = Builder(wasm).makeBrOn(op, name, ref, intendedType);
+    return true;
+  }
   Expression* rtt = nullptr;
   if (op == BrOnCast || op == BrOnCastFail) {
     rtt = popNonVoidExpression();
diff --git a/src/wasm/wasm-s-parser.cpp b/src/wasm/wasm-s-parser.cpp
index 28028c459..3cfe90e26 100644
--- a/src/wasm/wasm-s-parser.cpp
+++ b/src/wasm/wasm-s-parser.cpp
@@ -2574,12 +2574,24 @@ Expression* SExpressionWasmBuilder::makeRefTest(Element& s) {
   return Builder(wasm).makeRefTest(ref, rtt);
 }
 
+Expression* SExpressionWasmBuilder::makeRefTestStatic(Element& s) {
+  auto heapType = parseHeapType(*s[1]);
+  auto* ref = parseExpression(*s[2]);
+  return Builder(wasm).makeRefTest(ref, heapType);
+}
+
 Expression* SExpressionWasmBuilder::makeRefCast(Element& s) {
   auto* ref = parseExpression(*s[1]);
   auto* rtt = parseExpression(*s[2]);
   return Builder(wasm).makeRefCast(ref, rtt);
 }
 
+Expression* SExpressionWasmBuilder::makeRefCastStatic(Element& s) {
+  auto heapType = parseHeapType(*s[1]);
+  auto* ref = parseExpression(*s[2]);
+  return Builder(wasm).makeRefCast(ref, heapType);
+}
+
 Expression* SExpressionWasmBuilder::makeBrOn(Element& s, BrOnOp op) {
   auto name = getLabel(*s[1]);
   auto* ref = parseExpression(*s[2]);
@@ -2591,6 +2603,13 @@ Expression* SExpressionWasmBuilder::makeBrOn(Element& s, BrOnOp op) {
     .validateAndMakeBrOn(op, name, ref, rtt);
 }
 
+Expression* SExpressionWasmBuilder::makeBrOnStatic(Element& s, BrOnOp op) {
+  auto name = getLabel(*s[1]);
+  auto heapType = parseHeapType(*s[2]);
+  auto* ref = parseExpression(*s[3]);
+  return Builder(wasm).makeBrOn(op, name, ref, heapType);
+}
+
 Expression* SExpressionWasmBuilder::makeRttCanon(Element& s) {
   return Builder(wasm).makeRttCanon(parseHeapType(*s[1]));
 }
diff --git a/src/wasm/wasm-stack.cpp b/src/wasm/wasm-stack.cpp
index e5460cf6f..b6424cdde 100644
--- a/src/wasm/wasm-stack.cpp
+++ b/src/wasm/wasm-stack.cpp
@@ -1942,11 +1942,23 @@ void BinaryInstWriter::visitCallRef(CallRef* curr) {
 }
 
 void BinaryInstWriter::visitRefTest(RefTest* curr) {
-  o << int8_t(BinaryConsts::GCPrefix) << U32LEB(BinaryConsts::RefTest);
+  o << int8_t(BinaryConsts::GCPrefix);
+  if (curr->rtt) {
+    o << U32LEB(BinaryConsts::RefTest);
+  } else {
+    o << U32LEB(BinaryConsts::RefTestStatic);
+    parent.writeIndexedHeapType(curr->intendedType);
+  }
 }
 
 void BinaryInstWriter::visitRefCast(RefCast* curr) {
-  o << int8_t(BinaryConsts::GCPrefix) << U32LEB(BinaryConsts::RefCast);
+  o << int8_t(BinaryConsts::GCPrefix);
+  if (curr->rtt) {
+    o << U32LEB(BinaryConsts::RefCast);
+  } else {
+    o << U32LEB(BinaryConsts::RefCastStatic);
+    parent.writeIndexedHeapType(curr->intendedType);
+  }
 }
 
 void BinaryInstWriter::visitBrOn(BrOn* curr) {
@@ -1958,10 +1970,20 @@ void BinaryInstWriter::visitBrOn(BrOn* curr) {
       o << int8_t(BinaryConsts::BrOnNonNull);
       break;
     case BrOnCast:
-      o << int8_t(BinaryConsts::GCPrefix) << U32LEB(BinaryConsts::BrOnCast);
+      o << int8_t(BinaryConsts::GCPrefix);
+      if (curr->rtt) {
+        o << U32LEB(BinaryConsts::BrOnCast);
+      } else {
+        o << U32LEB(BinaryConsts::BrOnCastStatic);
+      }
       break;
     case BrOnCastFail:
-      o << int8_t(BinaryConsts::GCPrefix) << U32LEB(BinaryConsts::BrOnCastFail);
+      o << int8_t(BinaryConsts::GCPrefix);
+      if (curr->rtt) {
+        o << U32LEB(BinaryConsts::BrOnCastFail);
+      } else {
+        o << U32LEB(BinaryConsts::BrOnCastStaticFail);
+      }
       break;
     case BrOnFunc:
       o << int8_t(BinaryConsts::GCPrefix) << U32LEB(BinaryConsts::BrOnFunc);
@@ -1985,6 +2007,9 @@ void BinaryInstWriter::visitBrOn(BrOn* curr) {
       WASM_UNREACHABLE("invalid br_on_*");
   }
   o << U32LEB(getBreakIndex(curr->name));
+  if ((curr->op == BrOnCast || curr->op == BrOnCastFail) && !curr->rtt) {
+    parent.writeIndexedHeapType(curr->intendedType);
+  }
 }
 
 void BinaryInstWriter::visitRttCanon(RttCanon* curr) {
diff --git a/src/wasm/wasm-validator.cpp b/src/wasm/wasm-validator.cpp
index 0de417ed7..1f6421609 100644
--- a/src/wasm/wasm-validator.cpp
+++ b/src/wasm/wasm-validator.cpp
@@ -2219,9 +2219,20 @@ void FunctionValidator::visitRefTest(RefTest* curr) {
     shouldBeTrue(
       curr->ref->type.isRef(), curr, "ref.test ref must have ref type");
   }
-  if (curr->rtt->type != Type::unreachable) {
-    shouldBeTrue(
-      curr->rtt->type.isRtt(), curr, "ref.test rtt must have rtt type");
+  if (curr->rtt) {
+    if (curr->rtt->type != Type::unreachable) {
+      shouldBeTrue(
+        curr->rtt->type.isRtt(), curr, "ref.test rtt must have rtt type");
+    }
+    shouldBeEqual(curr->intendedType,
+                  HeapType(),
+                  curr,
+                  "dynamic ref.test must not use intendedType field");
+  } else {
+    shouldBeUnequal(curr->intendedType,
+                    HeapType(),
+                    curr,
+                    "static ref.test must set intendedType field");
   }
 }
 
@@ -2232,9 +2243,20 @@ void FunctionValidator::visitRefCast(RefCast* curr) {
     shouldBeTrue(
       curr->ref->type.isRef(), curr, "ref.cast ref must have ref type");
   }
-  if (curr->rtt->type != Type::unreachable) {
-    shouldBeTrue(
-      curr->rtt->type.isRtt(), curr, "ref.cast rtt must have rtt type");
+  if (curr->rtt) {
+    if (curr->rtt->type != Type::unreachable) {
+      shouldBeTrue(
+        curr->rtt->type.isRtt(), curr, "ref.cast rtt must have rtt type");
+    }
+    shouldBeEqual(curr->intendedType,
+                  HeapType(),
+                  curr,
+                  "dynamic ref.cast must not use intendedType field");
+  } else {
+    shouldBeUnequal(curr->intendedType,
+                    HeapType(),
+                    curr,
+                    "static ref.cast must set intendedType field");
   }
 }
 
@@ -2247,14 +2269,29 @@ void FunctionValidator::visitBrOn(BrOn* curr) {
       curr->ref->type.isRef(), curr, "br_on_cast ref must have ref type");
   }
   if (curr->op == BrOnCast || curr->op == BrOnCastFail) {
-    // Note that an unreachable rtt is not supported: the text and binary
-    // formats do not provide the type, so if it's unreachable we should not
-    // even create a br_on_cast in such a case, as we'd have no idea what it
-    // casts to.
-    shouldBeTrue(
-      curr->rtt->type.isRtt(), curr, "br_on_cast rtt must have rtt type");
+    if (curr->rtt) {
+      // Note that an unreachable rtt is not supported: the text and binary
+      // formats do not provide the type, so if it's unreachable we should not
+      // even create a br_on_cast in such a case, as we'd have no idea what it
+      // casts to.
+      shouldBeTrue(
+        curr->rtt->type.isRtt(), curr, "br_on_cast rtt must have rtt type");
+      shouldBeEqual(curr->intendedType,
+                    HeapType(),
+                    curr,
+                    "dynamic br_on_cast* must not use intendedType field");
+    } else {
+      shouldBeUnequal(curr->intendedType,
+                      HeapType(),
+                      curr,
+                      "static br_on_cast* must set intendedType field");
+    }
   } else {
     shouldBeTrue(curr->rtt == nullptr, curr, "non-cast BrOn must not have rtt");
+    shouldBeEqual(curr->intendedType,
+                  HeapType(),
+                  curr,
+                  "non-cast br_on* must not set intendedType field");
   }
   noteBreak(curr->name, curr->getSentType(), curr);
 }
diff --git a/src/wasm/wasm.cpp b/src/wasm/wasm.cpp
index 2861c4cee..45137fffe 100644
--- a/src/wasm/wasm.cpp
+++ b/src/wasm/wasm.cpp
@@ -895,23 +895,33 @@ void CallRef::finalize(Type type_) {
 }
 
 void RefTest::finalize() {
-  if (ref->type == Type::unreachable || rtt->type == Type::unreachable) {
+  if (ref->type == Type::unreachable ||
+      (rtt && rtt->type == Type::unreachable)) {
     type = Type::unreachable;
   } else {
     type = Type::i32;
   }
 }
 
+HeapType RefTest::getIntendedType() {
+  return rtt ? rtt->type.getHeapType() : intendedType;
+}
+
 void RefCast::finalize() {
-  if (ref->type == Type::unreachable || rtt->type == Type::unreachable) {
+  if (ref->type == Type::unreachable ||
+      (rtt && rtt->type == Type::unreachable)) {
     type = Type::unreachable;
   } else {
     // The output of ref.cast may be null if the input is null (in that case the
     // null is passed through).
-    type = Type(rtt->type.getHeapType(), ref->type.getNullability());
+    type = Type(getIntendedType(), ref->type.getNullability());
   }
 }
 
+HeapType RefCast::getIntendedType() {
+  return rtt ? rtt->type.getHeapType() : intendedType;
+}
+
 void BrOn::finalize() {
   if (ref->type == Type::unreachable ||
       (rtt && rtt->type == Type::unreachable)) {
@@ -938,7 +948,7 @@ void BrOn::finalize() {
     case BrOnCastFail:
       // If we do not branch, the cast worked, and we have something of the cast
       // type.
-      type = Type(rtt->type.getHeapType(), NonNullable);
+      type = Type(getIntendedType(), NonNullable);
       break;
     case BrOnNonFunc:
       type = Type(HeapType::func, NonNullable);
@@ -954,6 +964,11 @@ void BrOn::finalize() {
   }
 }
 
+HeapType BrOn::getIntendedType() {
+  assert(op == BrOnCast || op == BrOnCastFail);
+  return rtt ? rtt->type.getHeapType() : intendedType;
+}
+
 Type BrOn::getSentType() {
   switch (op) {
     case BrOnNull:
@@ -971,7 +986,7 @@ Type BrOn::getSentType() {
       if (ref->type == Type::unreachable) {
         return Type::unreachable;
       }
-      return Type(rtt->type.getHeapType(), NonNullable);
+      return Type(getIntendedType(), NonNullable);
     case BrOnFunc:
       return Type::funcref;
     case BrOnData:
diff --git a/test/heap-types.wast b/test/heap-types.wast
index 750467946..be6da5330 100644
--- a/test/heap-types.wast
+++ b/test/heap-types.wast
@@ -396,4 +396,30 @@
       (rtt.canon $bytes)
     )
   )
+  (func $static-operations
+    (local $temp.A (ref null $struct.A))
+    (local $temp.B (ref null $struct.B))
+    (drop
+      (ref.test_static $struct.B (ref.null $struct.A))
+    )
+    (drop
+      (ref.cast_static $struct.B (ref.null $struct.A))
+    )
+    (drop
+      (block $out-B (result (ref $struct.B))
+        (local.set $temp.A
+          (br_on_cast_static $out-B $struct.B (ref.null $struct.A))
+        )
+        (unreachable)
+      )
+    )
+    (drop
+      (block $out-A (result (ref null $struct.A))
+        (local.set $temp.B
+          (br_on_cast_static_fail $out-A $struct.B (ref.null $struct.A))
+        )
+        (unreachable)
+      )
+    )
+  )
 )
diff --git a/test/heap-types.wast.from-wast b/test/heap-types.wast.from-wast
index 32e29bfba..9ca3b580b 100644
--- a/test/heap-types.wast.from-wast
+++ b/test/heap-types.wast.from-wast
@@ -1,8 +1,8 @@
 (module
  (type $struct.A (struct (field i32) (field f32) (field $named f64)))
- (type $vector (array (mut f64)))
- (type $none_=>_none (func))
  (type $struct.B (struct (field i8) (field (mut i16)) (field (ref $struct.A)) (field (mut (ref $struct.A)))))
+ (type $none_=>_none (func))
+ (type $vector (array (mut f64)))
  (type $grandchild (struct (field i32) (field i64)))
  (type $struct.C (struct (field $named-mut (mut f32))))
  (type $matrix (array (mut (ref null $vector))))
@@ -487,4 +487,38 @@
    (rtt.canon $bytes)
   )
  )
+ (func $static-operations
+  (local $temp.A (ref null $struct.A))
+  (local $temp.B (ref null $struct.B))
+  (drop
+   (ref.test_static $struct.B
+    (ref.null $struct.A)
+   )
+  )
+  (drop
+   (ref.cast_static $struct.B
+    (ref.null $struct.A)
+   )
+  )
+  (drop
+   (block $out-B (result (ref $struct.B))
+    (local.set $temp.A
+     (br_on_cast_static $out-B $struct.B
+      (ref.null $struct.A)
+     )
+    )
+    (unreachable)
+   )
+  )
+  (drop
+   (block $out-A (result (ref null $struct.A))
+    (local.set $temp.B
+     (br_on_cast_static_fail $out-A $struct.B
+      (ref.null $struct.A)
+     )
+    )
+    (unreachable)
+   )
+  )
+ )
 )
diff --git a/test/heap-types.wast.fromBinary b/test/heap-types.wast.fromBinary
index a9bff28f3..7ac581848 100644
--- a/test/heap-types.wast.fromBinary
+++ b/test/heap-types.wast.fromBinary
@@ -1,8 +1,8 @@
 (module
  (type $struct.A (struct (field i32) (field f32) (field $named f64)))
- (type $vector (array (mut f64)))
- (type $none_=>_none (func))
  (type $struct.B (struct (field i8) (field (mut i16)) (field (ref $struct.A)) (field (mut (ref $struct.A)))))
+ (type $none_=>_none (func))
+ (type $vector (array (mut f64)))
  (type $grandchild (struct (field i32) (field i64)))
  (type $matrix (array (mut (ref null $vector))))
  (type $struct.C (struct (field $named-mut (mut f32))))
@@ -442,5 +442,39 @@
    (rtt.canon $bytes)
   )
  )
+ (func $static-operations
+  (local $temp.A (ref null $struct.A))
+  (local $temp.B (ref null $struct.B))
+  (drop
+   (ref.test_static $struct.B
+    (ref.null $struct.A)
+   )
+  )
+  (drop
+   (ref.cast_static $struct.B
+    (ref.null $struct.A)
+   )
+  )
+  (drop
+   (block $label$1 (result (ref $struct.B))
+    (local.set $temp.A
+     (br_on_cast_static $label$1 $struct.B
+      (ref.null $struct.A)
+     )
+    )
+    (unreachable)
+   )
+  )
+  (drop
+   (block $label$2 (result (ref null $struct.A))
+    (local.set $temp.B
+     (br_on_cast_static_fail $label$2 $struct.B
+      (ref.null $struct.A)
+     )
+    )
+    (unreachable)
+   )
+  )
+ )
 )
 
diff --git a/test/heap-types.wast.fromBinary.noDebugInfo b/test/heap-types.wast.fromBinary.noDebugInfo
index 5857e6689..6a8991150 100644
--- a/test/heap-types.wast.fromBinary.noDebugInfo
+++ b/test/heap-types.wast.fromBinary.noDebugInfo
@@ -1,8 +1,8 @@
 (module
  (type ${i32_f32_f64} (struct (field i32) (field f32) (field f64)))
- (type $[mut:f64] (array (mut f64)))
- (type $none_=>_none (func))
  (type ${i8_mut:i16_ref|{i32_f32_f64}|_mut:ref|{i32_f32_f64}|} (struct (field i8) (field (mut i16)) (field (ref ${i32_f32_f64})) (field (mut (ref ${i32_f32_f64})))))
+ (type $none_=>_none (func))
+ (type $[mut:f64] (array (mut f64)))
  (type ${i32_i64} (struct (field i32) (field i64)))
  (type $[mut:ref?|[mut:f64]|] (array (mut (ref null $[mut:f64]))))
  (type ${mut:f32} (struct (field (mut f32))))
@@ -442,5 +442,39 @@
    (rtt.canon $[mut:i8])
   )
  )
+ (func $22
+  (local $0 (ref null ${i32_f32_f64}))
+  (local $1 (ref null ${i8_mut:i16_ref|{i32_f32_f64}|_mut:ref|{i32_f32_f64}|}))
+  (drop
+   (ref.test_static ${i8_mut:i16_ref|{i32_f32_f64}|_mut:ref|{i32_f32_f64}|}
+    (ref.null ${i32_f32_f64})
+   )
+  )
+  (drop
+   (ref.cast_static ${i8_mut:i16_ref|{i32_f32_f64}|_mut:ref|{i32_f32_f64}|}
+    (ref.null ${i32_f32_f64})
+   )
+  )
+  (drop
+   (block $label$1 (result (ref ${i8_mut:i16_ref|{i32_f32_f64}|_mut:ref|{i32_f32_f64}|}))
+    (local.set $0
+     (br_on_cast_static $label$1 ${i8_mut:i16_ref|{i32_f32_f64}|_mut:ref|{i32_f32_f64}|}
+      (ref.null ${i32_f32_f64})
+     )
+    )
+    (unreachable)
+   )
+  )
+  (drop
+   (block $label$2 (result (ref null ${i32_f32_f64}))
+    (local.set $1
+     (br_on_cast_static_fail $label$2 ${i8_mut:i16_ref|{i32_f32_f64}|_mut:ref|{i32_f32_f64}|}
+      (ref.null ${i32_f32_f64})
+     )
+    )
+    (unreachable)
+   )
+  )
+ )
 )
 
diff --git a/test/passes/Oz_fuzz-exec_all-features.txt b/test/passes/Oz_fuzz-exec_all-features.txt
index 4a9ccb137..4cb8f4142 100644
--- a/test/passes/Oz_fuzz-exec_all-features.txt
+++ b/test/passes/Oz_fuzz-exec_all-features.txt
@@ -73,9 +73,20 @@
 [LoggingExternalInterface logging 50]
 [fuzz-exec] calling array.init-packed
 [LoggingExternalInterface logging 8]
+[fuzz-exec] calling static-casts
+[LoggingExternalInterface logging 1]
+[LoggingExternalInterface logging 0]
+[LoggingExternalInterface logging 0]
+[LoggingExternalInterface logging 1]
+[LoggingExternalInterface logging 0]
+[LoggingExternalInterface logging 1]
+[fuzz-exec] calling static-br_on_cast
+[LoggingExternalInterface logging 3]
+[fuzz-exec] calling static-br_on_cast_fail
+[LoggingExternalInterface logging -2]
 (module
- (type $extendedstruct (struct (field (mut i32)) (field f64)))
  (type $struct (struct (field (mut i32))))
+ (type $extendedstruct (struct (field (mut i32)) (field f64)))
  (type $void_func (func))
  (type $bytes (array (mut i8)))
  (type $i32_=>_none (func (param i32)))
@@ -108,6 +119,9 @@
  (export "rtt_Fresh" (func $25))
  (export "array.init" (func $26))
  (export "array.init-packed" (func $27))
+ (export "static-casts" (func $28))
+ (export "static-br_on_cast" (func $29))
+ (export "static-br_on_cast_fail" (func $30))
  (func $0 (; has Stack IR ;)
   (local $0 i32)
   (call $log
@@ -511,6 +525,94 @@
    )
   )
  )
+ (func $28 (; has Stack IR ;)
+  (call $log
+   (i32.const 1)
+  )
+  (call $log
+   (i32.const 0)
+  )
+  (call $log
+   (ref.test_static $struct
+    (array.new_with_rtt $bytes
+     (i32.const 20)
+     (i32.const 10)
+     (rtt.canon $bytes)
+    )
+   )
+  )
+  (call $log
+   (ref.test_static $struct
+    (struct.new_default_with_rtt $struct
+     (rtt.canon $struct)
+    )
+   )
+  )
+  (call $log
+   (ref.test_static $extendedstruct
+    (struct.new_default_with_rtt $struct
+     (rtt.canon $struct)
+    )
+   )
+  )
+  (call $log
+   (ref.test_static $struct
+    (struct.new_default_with_rtt $extendedstruct
+     (rtt.canon $extendedstruct)
+    )
+   )
+  )
+ )
+ (func $29 (; has Stack IR ;)
+  (drop
+   (block $block (result (ref $struct))
+    (drop
+     (block $extendedblock (result (ref $extendedstruct))
+      (drop
+       (br_on_cast_static $block $struct
+        (br_on_cast_static $extendedblock $extendedstruct
+         (struct.new_default_with_rtt $struct
+          (rtt.canon $struct)
+         )
+        )
+       )
+      )
+      (call $log
+       (i32.const -1)
+      )
+      (return)
+     )
+    )
+    (call $log
+     (i32.const -2)
+    )
+    (return)
+   )
+  )
+  (call $log
+   (i32.const 3)
+  )
+ )
+ (func $30 (; has Stack IR ;)
+  (drop
+   (block $failblock (result (ref $struct))
+    (drop
+     (br_on_cast_static_fail $failblock $extendedstruct
+      (struct.new_default_with_rtt $struct
+       (rtt.canon $struct)
+      )
+     )
+    )
+    (call $log
+     (i32.const -1)
+    )
+    (return)
+   )
+  )
+  (call $log
+   (i32.const -2)
+  )
+ )
 )
 [fuzz-exec] calling structs
 [LoggingExternalInterface logging 0]
@@ -586,6 +688,17 @@
 [LoggingExternalInterface logging 50]
 [fuzz-exec] calling array.init-packed
 [LoggingExternalInterface logging 8]
+[fuzz-exec] calling static-casts
+[LoggingExternalInterface logging 1]
+[LoggingExternalInterface logging 0]
+[LoggingExternalInterface logging 0]
+[LoggingExternalInterface logging 1]
+[LoggingExternalInterface logging 0]
+[LoggingExternalInterface logging 1]
+[fuzz-exec] calling static-br_on_cast
+[LoggingExternalInterface logging 3]
+[fuzz-exec] calling static-br_on_cast_fail
+[LoggingExternalInterface logging -2]
 ignoring comparison of ExecutionResults!
 [fuzz-exec] calling foo
 [host limit allocation failure]
diff --git a/test/passes/Oz_fuzz-exec_all-features.wast b/test/passes/Oz_fuzz-exec_all-features.wast
index 93235922e..54bff9e5d 100644
--- a/test/passes/Oz_fuzz-exec_all-features.wast
+++ b/test/passes/Oz_fuzz-exec_all-features.wast
@@ -544,6 +544,100 @@
    (array.get_u $bytes (local.get $x) (i32.const 0))
   )
  )
+ (func "static-casts"
+  ;; Casting null returns null.
+  (call $log (ref.is_null
+   (ref.cast_static $struct (ref.null $struct))
+  ))
+  ;; Testing null returns 0.
+  (call $log
+   (ref.test_static $struct (ref.null $struct))
+  )
+  ;; Testing something completely wrong (struct vs array) returns 0.
+  (call $log
+   (ref.test_static $struct
+    (array.new_with_rtt $bytes
+     (i32.const 20)
+     (i32.const 10)
+     (rtt.canon $bytes)
+    )
+   )
+  )
+  ;; Testing a thing with the same type returns 1.
+  (call $log
+   (ref.test_static $struct
+    (struct.new_default_with_rtt $struct
+     (rtt.canon $struct)
+    )
+   )
+  )
+  ;; A bad downcast returns 0: we create a struct, which is not a extendedstruct.
+  (call $log
+   (ref.test_static $extendedstruct
+    (struct.new_default_with_rtt $struct
+     (rtt.canon $struct)
+    )
+   )
+  )
+  ;; Casting to a supertype works.
+  (call $log
+   (ref.test_static $struct
+    (struct.new_default_with_rtt $extendedstruct
+     (rtt.canon $extendedstruct)
+    )
+   )
+  )
+ )
+ (func "static-br_on_cast"
+  (local $any anyref)
+  ;; create a simple $struct, store it in an anyref
+  (local.set $any
+   (struct.new_default_with_rtt $struct (rtt.canon $struct))
+  )
+  (drop
+   (block $block (result ($ref $struct))
+    (drop
+     (block $extendedblock (result (ref $extendedstruct))
+      (drop
+       ;; second, try to cast our simple $struct to what it is, which will work
+       (br_on_cast_static $block $struct
+        ;; first, try to cast our simple $struct to an extended, which will fail
+        (br_on_cast_static $extendedblock $extendedstruct
+         (local.get $any)
+        )
+       )
+      )
+      (call $log (i32.const -1)) ;; we should never get here
+      (return)
+     )
+    )
+    (call $log (i32.const -2)) ;; we should never get here either
+    (return)
+   )
+  )
+  (call $log (i32.const 3)) ;; we should get here
+ )
+ (func "static-br_on_cast_fail"
+  (local $any anyref)
+  ;; create a simple $struct, store it in an anyref
+  (local.set $any
+   (struct.new_default_with_rtt $struct (rtt.canon $struct))
+  )
+  (drop
+   (block $failblock (result anyref)
+    (drop
+      ;; try to cast our simple $struct to an extended, which will fail
+     (br_on_cast_static_fail $failblock $extendedstruct
+      (local.get $any)
+     )
+    )
+    (call $log (i32.const -1)) ;; we should never get here
+    (return)
+   )
+  )
+  (call $log (i32.const -2)) ;; we should get here.
+  (return)
+ )
 )
 (module
  (type $[mut:i8] (array (mut i8)))