TupleOptimization: Properly handle subtyping in copies (#6786)

We used the target's type for the read from the source, but due to
subtyping those might be different.

Found by the fuzzer.

1 files changed, 40 insertions, 2 deletions

diff --git a/test/lit/passes/tuple-optimization.wast b/test/lit/passes/tuple-optimization.wast
index d092d479f..e0d68848e 100644
--- a/test/lit/passes/tuple-optimization.wast
+++ b/test/lit/passes/tuple-optimization.wast
@@ -15,7 +15,7 @@
   ;; CHECK-NEXT: )
   (func $just-set
     (local $tuple (tuple i32 i32))
-    ;; This tuple local can be optimized into separate locals per lane. The
+    ;; This tuple local can be optimized into separate locals per element. The
     ;; tuple local itself then has no uses and other passes will remove it.
     (local.set $tuple
       (tuple.make 2
@@ -38,7 +38,7 @@
   ;; CHECK-NEXT: )
   (func $just-get
     (local $tuple (tuple i32 i32))
-    ;; The default value of the tuple lanes is used here in the new locals we
+    ;; The default value of the tuple elements is used here in the new locals we
     ;; add.
     (drop
       (tuple.extract 2 0
@@ -1026,4 +1026,42 @@
       )
     )
   )
+
+  ;; CHECK:      (func $tuple.element.subtyping (type $0)
+  ;; CHECK-NEXT:  (local $tuple_null (tuple i32 nullref))
+  ;; CHECK-NEXT:  (local $tuple_eq (tuple i32 eqref))
+  ;; CHECK-NEXT:  (local $2 i32)
+  ;; CHECK-NEXT:  (local $3 nullref)
+  ;; CHECK-NEXT:  (local $4 i32)
+  ;; CHECK-NEXT:  (local $5 eqref)
+  ;; CHECK-NEXT:  (block
+  ;; CHECK-NEXT:   (local.set $2
+  ;; CHECK-NEXT:    (i32.const 0)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:   (local.set $3
+  ;; CHECK-NEXT:    (ref.null none)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT:  (local.set $4
+  ;; CHECK-NEXT:   (local.get $2)
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT:  (local.set $5
+  ;; CHECK-NEXT:   (local.get $3)
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT: )
+  (func $tuple.element.subtyping
+    (local $tuple_null (tuple i32 nullref))
+    (local $tuple_eq (tuple i32 eqref))
+    ;; The tee emits a nullref in the second element, which is written to an
+    ;; element of eqref. That is, the source and the target do not have
+    ;; identical type, which we need to properly handle and not error.
+    (local.set $tuple_eq
+      (local.tee $tuple_null
+        (tuple.make 2
+          (i32.const 0)
+          (ref.null none)
+        )
+      )
+    )
+  )
 )