Fix SSA on null refinement (#5886)

Similar to #5885 this was uncovered by #5881 #5882. Here we need to refinalize
when we replace a local.get with a null, since the null's type is more refined.

2 files changed, 39 insertions, 0 deletions

diff --git a/src/passes/SSAify.cpp b/src/passes/SSAify.cpp
index fb952933e..547b9cb53 100644
--- a/src/passes/SSAify.cpp
+++ b/src/passes/SSAify.cpp
@@ -53,6 +53,7 @@
 #include "ir/find_all.h"
 #include "ir/literal-utils.h"
 #include "ir/local-graph.h"
+#include "ir/utils.h"
 #include "pass.h"
 #include "support/permutations.h"
 #include "wasm-builder.h"
@@ -85,6 +86,7 @@ struct SSAify : public Pass {
   Function* func;
   // things we add to the function prologue
   std::vector<Expression*> functionPrepends;
+  bool refinalize = false;
 
   void runOnFunction(Module* module_, Function* func_) override {
     module = module_;
@@ -99,6 +101,10 @@ struct SSAify : public Pass {
     computeGetsAndPhis(graph);
     // add prepends to function
     addPrepends();
+
+    if (refinalize) {
+      ReFinalize().walkFunctionInModule(func, module);
+    }
   }
 
   void createNewIndexes(LocalGraph& graph) {
@@ -142,6 +148,11 @@ struct SSAify : public Pass {
             // zero it out
             (*graph.locations[get]) =
               LiteralUtils::makeZero(get->type, *module);
+            // If we replace a local.get with a null then we are refining the
+            // type that the parent receives to a bottom type.
+            if (get->type.isRef()) {
+              refinalize = true;
+            }
           } else {
             // No zero exists here, so this is a nondefaultable type. The
             // default won't be used anyhow, so this value does not really
diff --git a/test/lit/passes/ssa.wast b/test/lit/passes/ssa.wast
index ed5b94f7b..06fe450aa 100644
--- a/test/lit/passes/ssa.wast
+++ b/test/lit/passes/ssa.wast
@@ -2,6 +2,9 @@
 ;; RUN: wasm-opt %s -all --ssa -S -o - | filecheck %s
 
 (module
+ ;; CHECK:      (type $A (struct ))
+ (type $A (struct ))
+
  ;; CHECK:      (func $foo (type $none_=>_none)
  ;; CHECK-NEXT:  (nop)
  ;; CHECK-NEXT: )
@@ -31,4 +34,29 @@
   (local.set $x (ref.func $bar))
   (drop (local.get $x))
  )
+
+ ;; CHECK:      (func $refine-to-null (type $none_=>_ref|$A|) (result (ref $A))
+ ;; CHECK-NEXT:  (local $0 (ref null $A))
+ ;; CHECK-NEXT:  (block $label (result (ref none))
+ ;; CHECK-NEXT:   (drop
+ ;; CHECK-NEXT:    (br_on_cast $label nullref (ref none)
+ ;; CHECK-NEXT:     (ref.null none)
+ ;; CHECK-NEXT:    )
+ ;; CHECK-NEXT:   )
+ ;; CHECK-NEXT:   (unreachable)
+ ;; CHECK-NEXT:  )
+ ;; CHECK-NEXT: )
+ (func $refine-to-null (result (ref $A))
+  (local $0 (ref null $A))
+  (block $label (result (ref $A))
+   (drop
+    (br_on_cast $label (ref null $A) (ref $A)
+     ;; This will turn into a null, which has a more refined type that affects
+     ;; the br_on_cast parent.
+     (local.get $0)
+    )
+   )
+   (unreachable)
+  )
+ )
 )