Fix binary emitting of br_if with a refined value by emitting a cast (#6510)

This makes us compliant with the wasm spec by adding a cast: we use the refined
type for br_if fallthrough values, and the wasm spec uses the branch target. If the
two differ, we add a cast after the br_if to make things match.

Alternatively we could match the wasm spec's typing in our IR, but we hope the wasm
spec will improve here, and so this is will only be temporary in that case. Even if not,
this is useful because by using the most refined type in the IR we optimize in the best
way possible, and only suffer when we emit fixups in the binary, but in practice those
cases are very rare: br_if is almost always dropped rather than used, in real-world
code (except for fuzz cases and exploits).

We check carefully when a br_if value is actually used (and not dropped) and its type
actually differs, and it does not already have a cast. The last condition ensures that
we do not keep adding casts over repeated roundtripping.

4 files changed, 749 insertions, 64 deletions

diff --git a/test/lit/basic/reference-types.wast b/test/lit/basic/reference-types.wast
index c4bfe8a45..7f9ba4219 100644
--- a/test/lit/basic/reference-types.wast
+++ b/test/lit/basic/reference-types.wast
@@ -25,7 +25,9 @@
 
   ;; CHECK-BIN:      (type $sig_funcref (func (param funcref)))
 
-  ;; CHECK-BIN:      (type $3 (func (result funcref)))
+  ;; CHECK-BIN:      (type $3 (func))
+
+  ;; CHECK-BIN:      (type $4 (func (result funcref)))
 
   ;; CHECK-BIN:      (type $sig_eqref (func (param eqref)))
   (type $sig_eqref (func (param eqref)))
@@ -43,8 +45,6 @@
   ;; CHECK-TEXT:      (import "env" "import_global" (global $import_global eqref))
 
   ;; CHECK-TEXT:      (import "env" "import_func" (func $import_func (type $8) (param eqref) (result funcref)))
-  ;; CHECK-BIN:      (type $5 (func))
-
   ;; CHECK-BIN:      (type $6 (func (result eqref)))
 
   ;; CHECK-BIN:      (type $7 (func (param i32)))
@@ -128,7 +128,7 @@
   ;; CHECK-TEXT:      (func $foo (type $5)
   ;; CHECK-TEXT-NEXT:  (nop)
   ;; CHECK-TEXT-NEXT: )
-  ;; CHECK-BIN:      (func $foo (type $5)
+  ;; CHECK-BIN:      (func $foo (type $3)
   ;; CHECK-BIN-NEXT:  (nop)
   ;; CHECK-BIN-NEXT: )
   (func $foo)
@@ -140,11 +140,11 @@
 
   ;; CHECK-BIN-NODEBUG:      (type $2 (func (param funcref)))
 
-  ;; CHECK-BIN-NODEBUG:      (type $3 (func (result funcref)))
+  ;; CHECK-BIN-NODEBUG:      (type $3 (func))
 
-  ;; CHECK-BIN-NODEBUG:      (type $4 (func (param eqref)))
+  ;; CHECK-BIN-NODEBUG:      (type $4 (func (result funcref)))
 
-  ;; CHECK-BIN-NODEBUG:      (type $5 (func))
+  ;; CHECK-BIN-NODEBUG:      (type $5 (func (param eqref)))
 
   ;; CHECK-BIN-NODEBUG:      (type $6 (func (result eqref)))
 
@@ -722,7 +722,7 @@
   ;; CHECK-TEXT-NEXT:   )
   ;; CHECK-TEXT-NEXT:  )
   ;; CHECK-TEXT-NEXT: )
-  ;; CHECK-BIN:      (func $test (type $5)
+  ;; CHECK-BIN:      (func $test (type $3)
   ;; CHECK-BIN-NEXT:  (local $local_eqref eqref)
   ;; CHECK-BIN-NEXT:  (local $local_funcref funcref)
   ;; CHECK-BIN-NEXT:  (local $local_anyref anyref)
@@ -913,9 +913,11 @@
   ;; CHECK-BIN-NEXT:  )
   ;; CHECK-BIN-NEXT:  (drop
   ;; CHECK-BIN-NEXT:   (block $label$3 (result eqref)
-  ;; CHECK-BIN-NEXT:    (br_if $label$3
-  ;; CHECK-BIN-NEXT:     (ref.null none)
-  ;; CHECK-BIN-NEXT:     (i32.const 1)
+  ;; CHECK-BIN-NEXT:    (ref.cast nullref
+  ;; CHECK-BIN-NEXT:     (br_if $label$3
+  ;; CHECK-BIN-NEXT:      (ref.null none)
+  ;; CHECK-BIN-NEXT:      (i32.const 1)
+  ;; CHECK-BIN-NEXT:     )
   ;; CHECK-BIN-NEXT:    )
   ;; CHECK-BIN-NEXT:   )
   ;; CHECK-BIN-NEXT:  )
@@ -937,17 +939,21 @@
   ;; CHECK-BIN-NEXT:  )
   ;; CHECK-BIN-NEXT:  (drop
   ;; CHECK-BIN-NEXT:   (block $label$6 (result funcref)
-  ;; CHECK-BIN-NEXT:    (br_if $label$6
-  ;; CHECK-BIN-NEXT:     (ref.null nofunc)
-  ;; CHECK-BIN-NEXT:     (i32.const 1)
+  ;; CHECK-BIN-NEXT:    (ref.cast nullfuncref
+  ;; CHECK-BIN-NEXT:     (br_if $label$6
+  ;; CHECK-BIN-NEXT:      (ref.null nofunc)
+  ;; CHECK-BIN-NEXT:      (i32.const 1)
+  ;; CHECK-BIN-NEXT:     )
   ;; CHECK-BIN-NEXT:    )
   ;; CHECK-BIN-NEXT:   )
   ;; CHECK-BIN-NEXT:  )
   ;; CHECK-BIN-NEXT:  (drop
   ;; CHECK-BIN-NEXT:   (block $label$7 (result funcref)
-  ;; CHECK-BIN-NEXT:    (br_if $label$7
-  ;; CHECK-BIN-NEXT:     (ref.func $foo)
-  ;; CHECK-BIN-NEXT:     (i32.const 1)
+  ;; CHECK-BIN-NEXT:    (ref.cast (ref $3)
+  ;; CHECK-BIN-NEXT:     (br_if $label$7
+  ;; CHECK-BIN-NEXT:      (ref.func $foo)
+  ;; CHECK-BIN-NEXT:      (i32.const 1)
+  ;; CHECK-BIN-NEXT:     )
   ;; CHECK-BIN-NEXT:    )
   ;; CHECK-BIN-NEXT:   )
   ;; CHECK-BIN-NEXT:  )
@@ -969,25 +975,31 @@
   ;; CHECK-BIN-NEXT:  )
   ;; CHECK-BIN-NEXT:  (drop
   ;; CHECK-BIN-NEXT:   (block $label$10 (result anyref)
-  ;; CHECK-BIN-NEXT:    (br_if $label$10
-  ;; CHECK-BIN-NEXT:     (ref.null none)
-  ;; CHECK-BIN-NEXT:     (i32.const 1)
+  ;; CHECK-BIN-NEXT:    (ref.cast nullref
+  ;; CHECK-BIN-NEXT:     (br_if $label$10
+  ;; CHECK-BIN-NEXT:      (ref.null none)
+  ;; CHECK-BIN-NEXT:      (i32.const 1)
+  ;; CHECK-BIN-NEXT:     )
   ;; CHECK-BIN-NEXT:    )
   ;; CHECK-BIN-NEXT:   )
   ;; CHECK-BIN-NEXT:  )
   ;; CHECK-BIN-NEXT:  (drop
   ;; CHECK-BIN-NEXT:   (block $label$11 (result anyref)
-  ;; CHECK-BIN-NEXT:    (br_if $label$11
-  ;; CHECK-BIN-NEXT:     (local.get $local_eqref)
-  ;; CHECK-BIN-NEXT:     (i32.const 1)
+  ;; CHECK-BIN-NEXT:    (ref.cast eqref
+  ;; CHECK-BIN-NEXT:     (br_if $label$11
+  ;; CHECK-BIN-NEXT:      (local.get $local_eqref)
+  ;; CHECK-BIN-NEXT:      (i32.const 1)
+  ;; CHECK-BIN-NEXT:     )
   ;; CHECK-BIN-NEXT:    )
   ;; CHECK-BIN-NEXT:   )
   ;; CHECK-BIN-NEXT:  )
   ;; CHECK-BIN-NEXT:  (drop
   ;; CHECK-BIN-NEXT:   (block $label$12 (result anyref)
-  ;; CHECK-BIN-NEXT:    (br_if $label$12
-  ;; CHECK-BIN-NEXT:     (ref.null none)
-  ;; CHECK-BIN-NEXT:     (i32.const 1)
+  ;; CHECK-BIN-NEXT:    (ref.cast nullref
+  ;; CHECK-BIN-NEXT:     (br_if $label$12
+  ;; CHECK-BIN-NEXT:      (ref.null none)
+  ;; CHECK-BIN-NEXT:      (i32.const 1)
+  ;; CHECK-BIN-NEXT:     )
   ;; CHECK-BIN-NEXT:    )
   ;; CHECK-BIN-NEXT:   )
   ;; CHECK-BIN-NEXT:  )
@@ -1343,6 +1355,8 @@
     )
     (drop
       (block (result eqref)
+        ;; Note that we will end up emitting a cast here, and in several cases
+        ;; below, because the br_if value is more refined than the target block.
         (br_if 0 (ref.null eq) (i32.const 1))
       )
     )
@@ -1669,7 +1683,7 @@
   ;; CHECK-TEXT-NEXT:  (local $local_funcref funcref)
   ;; CHECK-TEXT-NEXT:  (local.get $local_funcref)
   ;; CHECK-TEXT-NEXT: )
-  ;; CHECK-BIN:      (func $return_funcref_local (type $3) (result funcref)
+  ;; CHECK-BIN:      (func $return_funcref_local (type $4) (result funcref)
   ;; CHECK-BIN-NEXT:  (local $local_funcref funcref)
   ;; CHECK-BIN-NEXT:  (local.get $local_funcref)
   ;; CHECK-BIN-NEXT: )
@@ -1681,7 +1695,7 @@
   ;; CHECK-TEXT:      (func $return_funcref_global (type $3) (result funcref)
   ;; CHECK-TEXT-NEXT:  (global.get $global_funcref)
   ;; CHECK-TEXT-NEXT: )
-  ;; CHECK-BIN:      (func $return_funcref_global (type $3) (result funcref)
+  ;; CHECK-BIN:      (func $return_funcref_global (type $4) (result funcref)
   ;; CHECK-BIN-NEXT:  (global.get $global_funcref)
   ;; CHECK-BIN-NEXT: )
   (func $return_funcref_global (result funcref)
@@ -1691,7 +1705,7 @@
   ;; CHECK-TEXT:      (func $return_funcref_null (type $3) (result funcref)
   ;; CHECK-TEXT-NEXT:  (ref.null nofunc)
   ;; CHECK-TEXT-NEXT: )
-  ;; CHECK-BIN:      (func $return_funcref_null (type $3) (result funcref)
+  ;; CHECK-BIN:      (func $return_funcref_null (type $4) (result funcref)
   ;; CHECK-BIN-NEXT:  (ref.null nofunc)
   ;; CHECK-BIN-NEXT: )
   (func $return_funcref_null (result funcref)
@@ -1701,7 +1715,7 @@
   ;; CHECK-TEXT:      (func $return_funcref_func (type $3) (result funcref)
   ;; CHECK-TEXT-NEXT:  (ref.func $foo)
   ;; CHECK-TEXT-NEXT: )
-  ;; CHECK-BIN:      (func $return_funcref_func (type $3) (result funcref)
+  ;; CHECK-BIN:      (func $return_funcref_func (type $4) (result funcref)
   ;; CHECK-BIN-NEXT:  (ref.func $foo)
   ;; CHECK-BIN-NEXT: )
   (func $return_funcref_func (result funcref)
@@ -1818,7 +1832,7 @@
   ;; CHECK-TEXT-NEXT:   (ref.null nofunc)
   ;; CHECK-TEXT-NEXT:  )
   ;; CHECK-TEXT-NEXT: )
-  ;; CHECK-BIN:      (func $returns_funcref (type $3) (result funcref)
+  ;; CHECK-BIN:      (func $returns_funcref (type $4) (result funcref)
   ;; CHECK-BIN-NEXT:  (local $local_funcref funcref)
   ;; CHECK-BIN-NEXT:  (return
   ;; CHECK-BIN-NEXT:   (local.get $local_funcref)
@@ -1892,7 +1906,7 @@
   ;; CHECK-TEXT-NEXT:   (ref.func $ref-taken-but-not-in-table)
   ;; CHECK-TEXT-NEXT:  )
   ;; CHECK-TEXT-NEXT: )
-  ;; CHECK-BIN:      (func $ref-user (type $5)
+  ;; CHECK-BIN:      (func $ref-user (type $3)
   ;; CHECK-BIN-NEXT:  (drop
   ;; CHECK-BIN-NEXT:   (ref.func $ref-taken-but-not-in-table)
   ;; CHECK-BIN-NEXT:  )
@@ -1908,7 +1922,7 @@
   ;; CHECK-TEXT:      (func $ref-taken-but-not-in-table (type $5)
   ;; CHECK-TEXT-NEXT:  (nop)
   ;; CHECK-TEXT-NEXT: )
-  ;; CHECK-BIN:      (func $ref-taken-but-not-in-table (type $5)
+  ;; CHECK-BIN:      (func $ref-taken-but-not-in-table (type $3)
   ;; CHECK-BIN-NEXT:  (nop)
   ;; CHECK-BIN-NEXT: )
   (func $ref-taken-but-not-in-table)
@@ -1919,7 +1933,7 @@
 
 ;; CHECK-BIN-NODEBUG:      (export "export_global" (global $gimport$0))
 
-;; CHECK-BIN-NODEBUG:      (func $0 (type $4) (param $0 eqref)
+;; CHECK-BIN-NODEBUG:      (func $0 (type $5) (param $0 eqref)
 ;; CHECK-BIN-NODEBUG-NEXT:  (nop)
 ;; CHECK-BIN-NODEBUG-NEXT: )
 
@@ -1931,11 +1945,11 @@
 ;; CHECK-BIN-NODEBUG-NEXT:  (nop)
 ;; CHECK-BIN-NODEBUG-NEXT: )
 
-;; CHECK-BIN-NODEBUG:      (func $3 (type $5)
+;; CHECK-BIN-NODEBUG:      (func $3 (type $3)
 ;; CHECK-BIN-NODEBUG-NEXT:  (nop)
 ;; CHECK-BIN-NODEBUG-NEXT: )
 
-;; CHECK-BIN-NODEBUG:      (func $4 (type $5)
+;; CHECK-BIN-NODEBUG:      (func $4 (type $3)
 ;; CHECK-BIN-NODEBUG-NEXT:  (local $0 eqref)
 ;; CHECK-BIN-NODEBUG-NEXT:  (local $1 funcref)
 ;; CHECK-BIN-NODEBUG-NEXT:  (local $2 anyref)
@@ -2056,15 +2070,15 @@
 ;; CHECK-BIN-NODEBUG-NEXT:  (call $2
 ;; CHECK-BIN-NODEBUG-NEXT:   (ref.null none)
 ;; CHECK-BIN-NODEBUG-NEXT:  )
-;; CHECK-BIN-NODEBUG-NEXT:  (call_indirect $0 (type $4)
+;; CHECK-BIN-NODEBUG-NEXT:  (call_indirect $0 (type $5)
 ;; CHECK-BIN-NODEBUG-NEXT:   (local.get $0)
 ;; CHECK-BIN-NODEBUG-NEXT:   (i32.const 0)
 ;; CHECK-BIN-NODEBUG-NEXT:  )
-;; CHECK-BIN-NODEBUG-NEXT:  (call_indirect $0 (type $4)
+;; CHECK-BIN-NODEBUG-NEXT:  (call_indirect $0 (type $5)
 ;; CHECK-BIN-NODEBUG-NEXT:   (global.get $global$0)
 ;; CHECK-BIN-NODEBUG-NEXT:   (i32.const 0)
 ;; CHECK-BIN-NODEBUG-NEXT:  )
-;; CHECK-BIN-NODEBUG-NEXT:  (call_indirect $0 (type $4)
+;; CHECK-BIN-NODEBUG-NEXT:  (call_indirect $0 (type $5)
 ;; CHECK-BIN-NODEBUG-NEXT:   (ref.null none)
 ;; CHECK-BIN-NODEBUG-NEXT:   (i32.const 0)
 ;; CHECK-BIN-NODEBUG-NEXT:  )
@@ -2126,9 +2140,11 @@
 ;; CHECK-BIN-NODEBUG-NEXT:  )
 ;; CHECK-BIN-NODEBUG-NEXT:  (drop
 ;; CHECK-BIN-NODEBUG-NEXT:   (block $label$3 (result eqref)
-;; CHECK-BIN-NODEBUG-NEXT:    (br_if $label$3
-;; CHECK-BIN-NODEBUG-NEXT:     (ref.null none)
-;; CHECK-BIN-NODEBUG-NEXT:     (i32.const 1)
+;; CHECK-BIN-NODEBUG-NEXT:    (ref.cast nullref
+;; CHECK-BIN-NODEBUG-NEXT:     (br_if $label$3
+;; CHECK-BIN-NODEBUG-NEXT:      (ref.null none)
+;; CHECK-BIN-NODEBUG-NEXT:      (i32.const 1)
+;; CHECK-BIN-NODEBUG-NEXT:     )
 ;; CHECK-BIN-NODEBUG-NEXT:    )
 ;; CHECK-BIN-NODEBUG-NEXT:   )
 ;; CHECK-BIN-NODEBUG-NEXT:  )
@@ -2150,17 +2166,21 @@
 ;; CHECK-BIN-NODEBUG-NEXT:  )
 ;; CHECK-BIN-NODEBUG-NEXT:  (drop
 ;; CHECK-BIN-NODEBUG-NEXT:   (block $label$6 (result funcref)
-;; CHECK-BIN-NODEBUG-NEXT:    (br_if $label$6
-;; CHECK-BIN-NODEBUG-NEXT:     (ref.null nofunc)
-;; CHECK-BIN-NODEBUG-NEXT:     (i32.const 1)
+;; CHECK-BIN-NODEBUG-NEXT:    (ref.cast nullfuncref
+;; CHECK-BIN-NODEBUG-NEXT:     (br_if $label$6
+;; CHECK-BIN-NODEBUG-NEXT:      (ref.null nofunc)
+;; CHECK-BIN-NODEBUG-NEXT:      (i32.const 1)
+;; CHECK-BIN-NODEBUG-NEXT:     )
 ;; CHECK-BIN-NODEBUG-NEXT:    )
 ;; CHECK-BIN-NODEBUG-NEXT:   )
 ;; CHECK-BIN-NODEBUG-NEXT:  )
 ;; CHECK-BIN-NODEBUG-NEXT:  (drop
 ;; CHECK-BIN-NODEBUG-NEXT:   (block $label$7 (result funcref)
-;; CHECK-BIN-NODEBUG-NEXT:    (br_if $label$7
-;; CHECK-BIN-NODEBUG-NEXT:     (ref.func $3)
-;; CHECK-BIN-NODEBUG-NEXT:     (i32.const 1)
+;; CHECK-BIN-NODEBUG-NEXT:    (ref.cast (ref $3)
+;; CHECK-BIN-NODEBUG-NEXT:     (br_if $label$7
+;; CHECK-BIN-NODEBUG-NEXT:      (ref.func $3)
+;; CHECK-BIN-NODEBUG-NEXT:      (i32.const 1)
+;; CHECK-BIN-NODEBUG-NEXT:     )
 ;; CHECK-BIN-NODEBUG-NEXT:    )
 ;; CHECK-BIN-NODEBUG-NEXT:   )
 ;; CHECK-BIN-NODEBUG-NEXT:  )
@@ -2182,25 +2202,31 @@
 ;; CHECK-BIN-NODEBUG-NEXT:  )
 ;; CHECK-BIN-NODEBUG-NEXT:  (drop
 ;; CHECK-BIN-NODEBUG-NEXT:   (block $label$10 (result anyref)
-;; CHECK-BIN-NODEBUG-NEXT:    (br_if $label$10
-;; CHECK-BIN-NODEBUG-NEXT:     (ref.null none)
-;; CHECK-BIN-NODEBUG-NEXT:     (i32.const 1)
+;; CHECK-BIN-NODEBUG-NEXT:    (ref.cast nullref
+;; CHECK-BIN-NODEBUG-NEXT:     (br_if $label$10
+;; CHECK-BIN-NODEBUG-NEXT:      (ref.null none)
+;; CHECK-BIN-NODEBUG-NEXT:      (i32.const 1)
+;; CHECK-BIN-NODEBUG-NEXT:     )
 ;; CHECK-BIN-NODEBUG-NEXT:    )
 ;; CHECK-BIN-NODEBUG-NEXT:   )
 ;; CHECK-BIN-NODEBUG-NEXT:  )
 ;; CHECK-BIN-NODEBUG-NEXT:  (drop
 ;; CHECK-BIN-NODEBUG-NEXT:   (block $label$11 (result anyref)
-;; CHECK-BIN-NODEBUG-NEXT:    (br_if $label$11
-;; CHECK-BIN-NODEBUG-NEXT:     (local.get $0)
-;; CHECK-BIN-NODEBUG-NEXT:     (i32.const 1)
+;; CHECK-BIN-NODEBUG-NEXT:    (ref.cast eqref
+;; CHECK-BIN-NODEBUG-NEXT:     (br_if $label$11
+;; CHECK-BIN-NODEBUG-NEXT:      (local.get $0)
+;; CHECK-BIN-NODEBUG-NEXT:      (i32.const 1)
+;; CHECK-BIN-NODEBUG-NEXT:     )
 ;; CHECK-BIN-NODEBUG-NEXT:    )
 ;; CHECK-BIN-NODEBUG-NEXT:   )
 ;; CHECK-BIN-NODEBUG-NEXT:  )
 ;; CHECK-BIN-NODEBUG-NEXT:  (drop
 ;; CHECK-BIN-NODEBUG-NEXT:   (block $label$12 (result anyref)
-;; CHECK-BIN-NODEBUG-NEXT:    (br_if $label$12
-;; CHECK-BIN-NODEBUG-NEXT:     (ref.null none)
-;; CHECK-BIN-NODEBUG-NEXT:     (i32.const 1)
+;; CHECK-BIN-NODEBUG-NEXT:    (ref.cast nullref
+;; CHECK-BIN-NODEBUG-NEXT:     (br_if $label$12
+;; CHECK-BIN-NODEBUG-NEXT:      (ref.null none)
+;; CHECK-BIN-NODEBUG-NEXT:      (i32.const 1)
+;; CHECK-BIN-NODEBUG-NEXT:     )
 ;; CHECK-BIN-NODEBUG-NEXT:    )
 ;; CHECK-BIN-NODEBUG-NEXT:   )
 ;; CHECK-BIN-NODEBUG-NEXT:  )
@@ -2484,20 +2510,20 @@
 ;; CHECK-BIN-NODEBUG-NEXT:  (ref.null none)
 ;; CHECK-BIN-NODEBUG-NEXT: )
 
-;; CHECK-BIN-NODEBUG:      (func $8 (type $3) (result funcref)
+;; CHECK-BIN-NODEBUG:      (func $8 (type $4) (result funcref)
 ;; CHECK-BIN-NODEBUG-NEXT:  (local $0 funcref)
 ;; CHECK-BIN-NODEBUG-NEXT:  (local.get $0)
 ;; CHECK-BIN-NODEBUG-NEXT: )
 
-;; CHECK-BIN-NODEBUG:      (func $9 (type $3) (result funcref)
+;; CHECK-BIN-NODEBUG:      (func $9 (type $4) (result funcref)
 ;; CHECK-BIN-NODEBUG-NEXT:  (global.get $global$1)
 ;; CHECK-BIN-NODEBUG-NEXT: )
 
-;; CHECK-BIN-NODEBUG:      (func $10 (type $3) (result funcref)
+;; CHECK-BIN-NODEBUG:      (func $10 (type $4) (result funcref)
 ;; CHECK-BIN-NODEBUG-NEXT:  (ref.null nofunc)
 ;; CHECK-BIN-NODEBUG-NEXT: )
 
-;; CHECK-BIN-NODEBUG:      (func $11 (type $3) (result funcref)
+;; CHECK-BIN-NODEBUG:      (func $11 (type $4) (result funcref)
 ;; CHECK-BIN-NODEBUG-NEXT:  (ref.func $3)
 ;; CHECK-BIN-NODEBUG-NEXT: )
 
@@ -2534,7 +2560,7 @@
 ;; CHECK-BIN-NODEBUG-NEXT:  )
 ;; CHECK-BIN-NODEBUG-NEXT: )
 
-;; CHECK-BIN-NODEBUG:      (func $19 (type $3) (result funcref)
+;; CHECK-BIN-NODEBUG:      (func $19 (type $4) (result funcref)
 ;; CHECK-BIN-NODEBUG-NEXT:  (local $0 funcref)
 ;; CHECK-BIN-NODEBUG-NEXT:  (return
 ;; CHECK-BIN-NODEBUG-NEXT:   (local.get $0)
@@ -2556,12 +2582,12 @@
 ;; CHECK-BIN-NODEBUG-NEXT:  )
 ;; CHECK-BIN-NODEBUG-NEXT: )
 
-;; CHECK-BIN-NODEBUG:      (func $22 (type $5)
+;; CHECK-BIN-NODEBUG:      (func $22 (type $3)
 ;; CHECK-BIN-NODEBUG-NEXT:  (drop
 ;; CHECK-BIN-NODEBUG-NEXT:   (ref.func $23)
 ;; CHECK-BIN-NODEBUG-NEXT:  )
 ;; CHECK-BIN-NODEBUG-NEXT: )
 
-;; CHECK-BIN-NODEBUG:      (func $23 (type $5)
+;; CHECK-BIN-NODEBUG:      (func $23 (type $3)
 ;; CHECK-BIN-NODEBUG-NEXT:  (nop)
 ;; CHECK-BIN-NODEBUG-NEXT: )
diff --git a/test/lit/cast-and-recast-tuple.wast b/test/lit/cast-and-recast-tuple.wast
new file mode 100644
index 000000000..7f0886fce
--- /dev/null
+++ b/test/lit/cast-and-recast-tuple.wast
@@ -0,0 +1,444 @@
+;; NOTE: Assertions have been generated by update_lit_checks.py and should not be edited.
+
+;; Part of cast-and-recast.wast, but containing tuples. This is split out
+;; because we do not roundtrip tuple-containing code properly. We also use only
+;; one roundtrip because of the accumulation of tuple logic, which would
+;; otherwise make the output here very hard to read.
+
+;; RUN: wasm-opt %s -all --roundtrip -S -o - | filecheck %s
+
+(module
+  (rec
+    ;; CHECK:      (rec
+    ;; CHECK-NEXT:  (type $A (sub (struct )))
+    (type $A (sub (struct)))
+    ;; CHECK:       (type $B (sub $A (struct )))
+    (type $B (sub $A (struct)))
+  )
+
+  ;; CHECK:      (func $test-local-tuple-1 (type $5) (param $B (ref $B)) (param $x i32) (result anyref i32)
+  ;; CHECK-NEXT:  (local $2 (tuple (ref $B) i32))
+  ;; CHECK-NEXT:  (local $3 (ref $B))
+  ;; CHECK-NEXT:  (local $4 (tuple (ref $A) i32))
+  ;; CHECK-NEXT:  (local.set $4
+  ;; CHECK-NEXT:   (block $label$1 (type $3) (result (ref $A) i32)
+  ;; CHECK-NEXT:    (local.set $2
+  ;; CHECK-NEXT:     (br_if $label$1
+  ;; CHECK-NEXT:      (tuple.make 2
+  ;; CHECK-NEXT:       (local.get $B)
+  ;; CHECK-NEXT:       (i32.const 3)
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:      (local.get $x)
+  ;; CHECK-NEXT:     )
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:    (drop
+  ;; CHECK-NEXT:     (block (result (ref $B))
+  ;; CHECK-NEXT:      (local.set $3
+  ;; CHECK-NEXT:       (tuple.extract 2 0
+  ;; CHECK-NEXT:        (local.get $2)
+  ;; CHECK-NEXT:       )
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:      (drop
+  ;; CHECK-NEXT:       (tuple.extract 2 1
+  ;; CHECK-NEXT:        (local.get $2)
+  ;; CHECK-NEXT:       )
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:      (local.get $3)
+  ;; CHECK-NEXT:     )
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:    (unreachable)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT:  (tuple.make 2
+  ;; CHECK-NEXT:   (tuple.extract 2 0
+  ;; CHECK-NEXT:    (local.get $4)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:   (tuple.extract 2 1
+  ;; CHECK-NEXT:    (local.get $4)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT: )
+  (func $test-local-tuple-1 (param $B (ref $B)) (param $x i32) (result anyref i32)
+    ;; A dropped tuple that contains a ref. As it is dropped, we do not need to
+    ;; do anything for this br_if. However, due to our general handling of
+    ;; tuples the code here will grow quite a bit due the roundtrip, but we can
+    ;; at least verify that there is no ref.cast added anywhere here.
+    (block $out (result (ref $A) i32)
+      (tuple.drop 2
+        (br_if $out
+          (tuple.make 2
+            (local.get $B)
+            (i32.const 3)
+          )
+          (local.get $x)
+        )
+      )
+      (unreachable)
+    )
+  )
+
+  ;; CHECK:      (func $test-local-tuple-2 (type $9) (param $B (ref $B)) (param $x i32) (result i32 i32)
+  ;; CHECK-NEXT:  (local $temp i32)
+  ;; CHECK-NEXT:  (local $3 i32)
+  ;; CHECK-NEXT:  (local $4 (tuple i32 i32))
+  ;; CHECK-NEXT:  (local $5 i32)
+  ;; CHECK-NEXT:  (local $6 (tuple i32 i32))
+  ;; CHECK-NEXT:  (local.set $6
+  ;; CHECK-NEXT:   (block $label$1 (type $4) (result i32 i32)
+  ;; CHECK-NEXT:    (local.set $4
+  ;; CHECK-NEXT:     (br_if $label$1
+  ;; CHECK-NEXT:      (tuple.make 2
+  ;; CHECK-NEXT:       (i32.const -1)
+  ;; CHECK-NEXT:       (i32.const 3)
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:      (local.get $x)
+  ;; CHECK-NEXT:     )
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:    (local.set $temp
+  ;; CHECK-NEXT:     (block (result i32)
+  ;; CHECK-NEXT:      (local.set $5
+  ;; CHECK-NEXT:       (tuple.extract 2 0
+  ;; CHECK-NEXT:        (local.get $4)
+  ;; CHECK-NEXT:       )
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:      (local.set $3
+  ;; CHECK-NEXT:       (tuple.extract 2 1
+  ;; CHECK-NEXT:        (local.get $4)
+  ;; CHECK-NEXT:       )
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:      (local.get $5)
+  ;; CHECK-NEXT:     )
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:    (unreachable)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT:  (tuple.make 2
+  ;; CHECK-NEXT:   (tuple.extract 2 0
+  ;; CHECK-NEXT:    (local.get $6)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:   (tuple.extract 2 1
+  ;; CHECK-NEXT:    (local.get $6)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT: )
+  (func $test-local-tuple-2 (param $B (ref $B)) (param $x i32) (result i32 i32)
+    (local $temp (tuple i32 i32))
+    ;; This tuple is not dropped, but it contains no references, so we do not
+    ;; need to do anything for the br_if, and we add no casts.
+    (block $out (result i32 i32)
+      (local.set $temp
+        (br_if $out
+          (tuple.make 2
+            (i32.const -1)
+            (i32.const 3)
+          )
+          (local.get $x)
+        )
+      )
+      (unreachable)
+    )
+  )
+
+  ;; CHECK:      (func $test-local-tuple-3 (type $5) (param $B (ref $B)) (param $x i32) (result anyref i32)
+  ;; CHECK-NEXT:  (local $temp (ref $B))
+  ;; CHECK-NEXT:  (local $3 i32)
+  ;; CHECK-NEXT:  (local $4 (tuple (ref $B) i32))
+  ;; CHECK-NEXT:  (local $5 (ref $B))
+  ;; CHECK-NEXT:  (local $6 (tuple (ref $B) i32))
+  ;; CHECK-NEXT:  (local.set $6
+  ;; CHECK-NEXT:   (block $label$1 (type $6) (result (ref $B) i32)
+  ;; CHECK-NEXT:    (local.set $4
+  ;; CHECK-NEXT:     (br_if $label$1
+  ;; CHECK-NEXT:      (tuple.make 2
+  ;; CHECK-NEXT:       (local.get $B)
+  ;; CHECK-NEXT:       (i32.const 3)
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:      (local.get $x)
+  ;; CHECK-NEXT:     )
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:    (local.set $temp
+  ;; CHECK-NEXT:     (block (result (ref $B))
+  ;; CHECK-NEXT:      (local.set $5
+  ;; CHECK-NEXT:       (tuple.extract 2 0
+  ;; CHECK-NEXT:        (local.get $4)
+  ;; CHECK-NEXT:       )
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:      (local.set $3
+  ;; CHECK-NEXT:       (tuple.extract 2 1
+  ;; CHECK-NEXT:        (local.get $4)
+  ;; CHECK-NEXT:       )
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:      (local.get $5)
+  ;; CHECK-NEXT:     )
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:    (unreachable)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT:  (tuple.make 2
+  ;; CHECK-NEXT:   (tuple.extract 2 0
+  ;; CHECK-NEXT:    (local.get $6)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:   (tuple.extract 2 1
+  ;; CHECK-NEXT:    (local.get $6)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT: )
+  (func $test-local-tuple-3 (param $B (ref $B)) (param $x i32) (result anyref i32)
+    (local $temp (tuple (ref $B) i32))
+    ;; This is not dropped and has a reference, but it has the right type, so no
+    ;; cast is needed.
+    (block $out (result (ref $B) i32)
+      (local.set $temp
+        (br_if $out
+          (tuple.make 2
+            (local.get $B)
+            (i32.const 3)
+          )
+          (local.get $x)
+        )
+      )
+      (unreachable)
+    )
+  )
+
+  ;; CHECK:      (func $test-local-tuple-4-bad (type $5) (param $B (ref $B)) (param $x i32) (result anyref i32)
+  ;; CHECK-NEXT:  (local $temp (ref $B))
+  ;; CHECK-NEXT:  (local $3 (ref $A))
+  ;; CHECK-NEXT:  (local $4 i32)
+  ;; CHECK-NEXT:  (local $5 i32)
+  ;; CHECK-NEXT:  (local $6 (tuple (ref $B) i32))
+  ;; CHECK-NEXT:  (local $7 (ref $B))
+  ;; CHECK-NEXT:  (local $8 (ref $B))
+  ;; CHECK-NEXT:  (local $9 (tuple (ref $A) i32))
+  ;; CHECK-NEXT:  (local.set $9
+  ;; CHECK-NEXT:   (block $label$1 (type $3) (result (ref $A) i32)
+  ;; CHECK-NEXT:    (local.set $6
+  ;; CHECK-NEXT:     (br_if $label$1
+  ;; CHECK-NEXT:      (tuple.make 2
+  ;; CHECK-NEXT:       (local.get $B)
+  ;; CHECK-NEXT:       (i32.const 3)
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:      (local.get $x)
+  ;; CHECK-NEXT:     )
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:    (local.set $3
+  ;; CHECK-NEXT:     (block (result (ref $B))
+  ;; CHECK-NEXT:      (local.set $7
+  ;; CHECK-NEXT:       (tuple.extract 2 0
+  ;; CHECK-NEXT:        (local.get $6)
+  ;; CHECK-NEXT:       )
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:      (local.set $5
+  ;; CHECK-NEXT:       (tuple.extract 2 1
+  ;; CHECK-NEXT:        (local.get $6)
+  ;; CHECK-NEXT:       )
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:      (local.get $7)
+  ;; CHECK-NEXT:     )
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:    (local.set $temp
+  ;; CHECK-NEXT:     (block (result (ref $B))
+  ;; CHECK-NEXT:      (local.set $8
+  ;; CHECK-NEXT:       (ref.cast (ref $B)
+  ;; CHECK-NEXT:        (local.get $3)
+  ;; CHECK-NEXT:       )
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:      (local.set $4
+  ;; CHECK-NEXT:       (local.get $5)
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:      (local.get $8)
+  ;; CHECK-NEXT:     )
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:    (unreachable)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT:  (tuple.make 2
+  ;; CHECK-NEXT:   (tuple.extract 2 0
+  ;; CHECK-NEXT:    (local.get $9)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:   (tuple.extract 2 1
+  ;; CHECK-NEXT:    (local.get $9)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT: )
+  (func $test-local-tuple-4-bad (param $B (ref $B)) (param $x i32) (result anyref i32)
+    (local $temp (tuple (ref $B) i32))
+    ;; As above, but none of the mitigating circumstances happens: we have a
+    ;; tuple with a reference that is refined compared to the break target. As a
+    ;; result we must fix this up, which we do by adding locals, saving the
+    ;; br_if's output to them, and then loading from those locals and casting.
+    ;;
+    ;; Comparing to $test-local-tuple-4, we end up with 3 more locals, and also
+    ;; there is now a ref.cast.
+    (block $out (result (ref $A) i32)
+      (local.set $temp
+        (br_if $out
+          (tuple.make 2
+            (local.get $B)
+            (i32.const 3)
+          )
+          (local.get $x)
+        )
+      )
+      (unreachable)
+    )
+  )
+
+  ;; CHECK:      (func $test-local-tuple-4-bad-dupes (type $10) (param $B (ref $B)) (param $x i32) (result i32 anyref i32)
+  ;; CHECK-NEXT:  (local $temp (ref $B))
+  ;; CHECK-NEXT:  (local $3 (ref $B))
+  ;; CHECK-NEXT:  (local $4 (ref $A))
+  ;; CHECK-NEXT:  (local $5 i32)
+  ;; CHECK-NEXT:  (local $scratch i32)
+  ;; CHECK-NEXT:  (local $7 i32)
+  ;; CHECK-NEXT:  (local $8 i32)
+  ;; CHECK-NEXT:  (local $9 i32)
+  ;; CHECK-NEXT:  (local $10 (tuple i32 (ref $B) i32))
+  ;; CHECK-NEXT:  (local $11 (ref $B))
+  ;; CHECK-NEXT:  (local $12 i32)
+  ;; CHECK-NEXT:  (local $13 (ref $B))
+  ;; CHECK-NEXT:  (local $14 i32)
+  ;; CHECK-NEXT:  (local $15 (ref $B))
+  ;; CHECK-NEXT:  (local $16 (tuple i32 (ref $A) i32))
+  ;; CHECK-NEXT:  (local.set $16
+  ;; CHECK-NEXT:   (block $label$1 (type $7) (result i32 (ref $A) i32)
+  ;; CHECK-NEXT:    (local.set $10
+  ;; CHECK-NEXT:     (br_if $label$1
+  ;; CHECK-NEXT:      (tuple.make 3
+  ;; CHECK-NEXT:       (i32.const -3)
+  ;; CHECK-NEXT:       (local.get $B)
+  ;; CHECK-NEXT:       (i32.const 3)
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:      (local.get $x)
+  ;; CHECK-NEXT:     )
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:    (local.set $9
+  ;; CHECK-NEXT:     (block (result i32)
+  ;; CHECK-NEXT:      (local.set $12
+  ;; CHECK-NEXT:       (tuple.extract 3 0
+  ;; CHECK-NEXT:        (local.get $10)
+  ;; CHECK-NEXT:       )
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:      (local.set $4
+  ;; CHECK-NEXT:       (block (result (ref $B))
+  ;; CHECK-NEXT:        (local.set $11
+  ;; CHECK-NEXT:         (tuple.extract 3 1
+  ;; CHECK-NEXT:          (local.get $10)
+  ;; CHECK-NEXT:         )
+  ;; CHECK-NEXT:        )
+  ;; CHECK-NEXT:        (local.set $8
+  ;; CHECK-NEXT:         (tuple.extract 3 2
+  ;; CHECK-NEXT:          (local.get $10)
+  ;; CHECK-NEXT:         )
+  ;; CHECK-NEXT:        )
+  ;; CHECK-NEXT:        (local.get $11)
+  ;; CHECK-NEXT:       )
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:      (local.get $12)
+  ;; CHECK-NEXT:     )
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:    (drop
+  ;; CHECK-NEXT:     (local.tee $scratch
+  ;; CHECK-NEXT:      (block (result i32)
+  ;; CHECK-NEXT:       (local.set $14
+  ;; CHECK-NEXT:        (local.get $9)
+  ;; CHECK-NEXT:       )
+  ;; CHECK-NEXT:       (local.set $3
+  ;; CHECK-NEXT:        (block (result (ref $B))
+  ;; CHECK-NEXT:         (local.set $13
+  ;; CHECK-NEXT:          (ref.cast (ref $B)
+  ;; CHECK-NEXT:           (local.get $4)
+  ;; CHECK-NEXT:          )
+  ;; CHECK-NEXT:         )
+  ;; CHECK-NEXT:         (local.set $7
+  ;; CHECK-NEXT:          (local.get $8)
+  ;; CHECK-NEXT:         )
+  ;; CHECK-NEXT:         (local.get $13)
+  ;; CHECK-NEXT:        )
+  ;; CHECK-NEXT:       )
+  ;; CHECK-NEXT:       (local.get $14)
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:     )
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:    (local.set $temp
+  ;; CHECK-NEXT:     (block (result (ref $B))
+  ;; CHECK-NEXT:      (local.set $15
+  ;; CHECK-NEXT:       (local.get $3)
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:      (local.set $5
+  ;; CHECK-NEXT:       (local.get $7)
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:      (local.get $15)
+  ;; CHECK-NEXT:     )
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:    (unreachable)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT:  (tuple.make 3
+  ;; CHECK-NEXT:   (tuple.extract 3 0
+  ;; CHECK-NEXT:    (local.get $16)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:   (tuple.extract 3 1
+  ;; CHECK-NEXT:    (local.get $16)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:   (tuple.extract 3 2
+  ;; CHECK-NEXT:    (local.get $16)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT: )
+  (func $test-local-tuple-4-bad-dupes (param $B (ref $B)) (param $x i32) (result i32 anyref i32)
+    (local $temp (tuple (ref $B) i32))
+    ;; As above, but now the tuple has multiple appearances of the same type in
+    ;; it, each of which needs its own scratch local. We can see in the output
+    ;; that the tuple.extracts use different locals for the first and last i32.
+    ;; For easier reading, here is the wami output of the binary:
+    ;;
+    ;;   (func $func4 (param $var0 (ref $type1)) (param $var1 i32) (result i32) (result anyref) (result i32)
+    ;;     (local $var2 (ref $type1))
+    ;;     (local $var3 (ref $type1))
+    ;;     (local $var4 (ref $type0))
+    ;;     (local $var5 i32)
+    ;;     (local $var6 i32)
+    ;;     (local $var7 i32)
+    ;;     (local $var8 i32)
+    ;;     (local $var9 i32)
+    ;;     block $label0 (result i32) (result (ref $type0)) (result i32)
+    ;;       i32.const -3
+    ;;       local.get $var0
+    ;;       i32.const 3
+    ;;       local.get $var1
+    ;;       br_if $label0
+    ;;       local.set $var8 ;; saves 3
+    ;;       local.set $var4 ;; saves the ref
+    ;;       local.set $var9 ;; saves -3
+    ;;       local.get $var9 ;; gets -3
+    ;;       local.get $var4 ;; gets the ref
+    ;;       ref.cast $type1 ;; casts the ref
+    ;;       local.get $var8 ;; gets 3
+    ;;       local.set $var7
+    ;;       local.set $var3
+    ;;       local.tee $var6
+    ;;       drop
+    ;;       local.get $var3
+    ;;       local.get $var7
+    ;;       local.set $var5
+    ;;       local.set $var2
+    ;;       unreachable
+    ;;     end $label0
+    ;;   )
+    ;;
+    (block $out (result i32 (ref $A) i32)
+      (local.set $temp
+        (br_if $out
+          (tuple.make 3
+            (i32.const -3) ;; this was added
+            (local.get $B)
+            (i32.const 3)
+          )
+          (local.get $x)
+        )
+      )
+      (unreachable)
+    )
+  )
+)
diff --git a/test/lit/cast-and-recast.wast b/test/lit/cast-and-recast.wast
new file mode 100644
index 000000000..c25ccc69a
--- /dev/null
+++ b/test/lit/cast-and-recast.wast
@@ -0,0 +1,185 @@
+;; NOTE: Assertions have been generated by update_lit_checks.py and should not be edited.
+
+;; Test that our hack for br_if output types does not cause the binary to grow
+;; linearly with each roundtrip (note the three roundtrips here). When we emit
+;; a br_if whose output type is not refined enough (Binaryen IR uses the value's
+;; type; wasm uses the target's) then we add a cast.
+
+;; RUN: wasm-opt %s -all --roundtrip --roundtrip --roundtrip -S -o - | filecheck %s
+
+(module
+  (rec
+    ;; CHECK:      (rec
+    ;; CHECK-NEXT:  (type $A (sub (struct )))
+    (type $A (sub (struct)))
+    ;; CHECK:       (type $B (sub $A (struct )))
+    (type $B (sub $A (struct)))
+    ;; CHECK:       (type $C (sub $B (struct )))
+    (type $C (sub $B (struct)))
+  )
+
+  ;; CHECK:      (func $test (type $3) (param $B (ref $B)) (param $x i32) (result anyref)
+  ;; CHECK-NEXT:  (block $label$1 (result (ref $A))
+  ;; CHECK-NEXT:   (ref.cast (ref $B)
+  ;; CHECK-NEXT:    (br_if $label$1
+  ;; CHECK-NEXT:     (local.get $B)
+  ;; CHECK-NEXT:     (local.get $x)
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT: )
+  (func $test (param $B (ref $B)) (param $x i32) (result anyref)
+    (block $out (result (ref $A))
+      ;; The br_if's value is of type $B which is more precise than the block's
+      ;; type, $A, so we emit a cast here, but only one despite the three
+      ;; roundtrips.
+      (br_if $out
+        (local.get $B)
+        (local.get $x)
+      )
+    )
+  )
+
+  ;; CHECK:      (func $test-cast (type $3) (param $B (ref $B)) (param $x i32) (result anyref)
+  ;; CHECK-NEXT:  (block $label$1 (result (ref $A))
+  ;; CHECK-NEXT:   (ref.cast (ref $B)
+  ;; CHECK-NEXT:    (br_if $label$1
+  ;; CHECK-NEXT:     (local.get $B)
+  ;; CHECK-NEXT:     (local.get $x)
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT: )
+  (func $test-cast (param $B (ref $B)) (param $x i32) (result anyref)
+    ;; This is the result of a single roundtrip: there is a cast. We should not
+    ;; modify this function at all in additional roundtrips.
+    (block $out (result (ref $A))
+      (ref.cast (ref $B)
+        (br_if $out
+          (local.get $B)
+          (local.get $x)
+        )
+      )
+    )
+  )
+
+  ;; CHECK:      (func $test-cast-more (type $3) (param $B (ref $B)) (param $x i32) (result anyref)
+  ;; CHECK-NEXT:  (block $label$1 (result (ref $A))
+  ;; CHECK-NEXT:   (ref.cast (ref $C)
+  ;; CHECK-NEXT:    (br_if $label$1
+  ;; CHECK-NEXT:     (local.get $B)
+  ;; CHECK-NEXT:     (local.get $x)
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT: )
+  (func $test-cast-more (param $B (ref $B)) (param $x i32) (result anyref)
+    ;; As above but the cast is more refined. Again, we do not need an
+    ;; additional cast.
+    (block $out (result (ref $A))
+      (ref.cast (ref $C)          ;; this changed
+        (br_if $out
+          (local.get $B)
+          (local.get $x)
+        )
+      )
+    )
+  )
+
+  ;; CHECK:      (func $test-cast-less (type $3) (param $B (ref $B)) (param $x i32) (result anyref)
+  ;; CHECK-NEXT:  (block $label$1 (result (ref $A))
+  ;; CHECK-NEXT:   (ref.cast (ref $B)
+  ;; CHECK-NEXT:    (br_if $label$1
+  ;; CHECK-NEXT:     (local.get $B)
+  ;; CHECK-NEXT:     (local.get $x)
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT: )
+  (func $test-cast-less (param $B (ref $B)) (param $x i32) (result anyref)
+    ;; As above but the cast is less refined. As a result we'd add a cast to $B
+    ;; (but we refine casts automatically in finalize(), so this cast becomes a
+    ;; cast to $B anyhow, and as a result we have only one cast here).
+    (block $out (result (ref $A))
+      (ref.cast (ref $A)          ;; this changed
+        (br_if $out
+          (local.get $B)
+          (local.get $x)
+        )
+      )
+    )
+  )
+
+  ;; CHECK:      (func $test-local (type $3) (param $B (ref $B)) (param $x i32) (result anyref)
+  ;; CHECK-NEXT:  (local $temp (ref $B))
+  ;; CHECK-NEXT:  (block $label$1 (result (ref $A))
+  ;; CHECK-NEXT:   (local.set $temp
+  ;; CHECK-NEXT:    (ref.cast (ref $B)
+  ;; CHECK-NEXT:     (br_if $label$1
+  ;; CHECK-NEXT:      (local.get $B)
+  ;; CHECK-NEXT:      (local.get $x)
+  ;; CHECK-NEXT:     )
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:   (unreachable)
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT: )
+  (func $test-local (param $B (ref $B)) (param $x i32) (result anyref)
+    (local $temp (ref $B))
+    ;; As above, but with local.set that receives the br_if's value, verifying
+    ;; it is refined. We emit a cast here.
+    (block $out (result (ref $A))
+      (local.set $temp
+        (br_if $out
+          (local.get $B)
+          (local.get $x)
+        )
+      )
+      (unreachable)
+    )
+  )
+
+  ;; CHECK:      (func $test-drop (type $3) (param $B (ref $B)) (param $x i32) (result anyref)
+  ;; CHECK-NEXT:  (block $label$1 (result (ref $A))
+  ;; CHECK-NEXT:   (drop
+  ;; CHECK-NEXT:    (br_if $label$1
+  ;; CHECK-NEXT:     (local.get $B)
+  ;; CHECK-NEXT:     (local.get $x)
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:   (unreachable)
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT: )
+  (func $test-drop (param $B (ref $B)) (param $x i32) (result anyref)
+    ;; As above, but with a drop of the br_if value. We do not emit a cast here.
+    (block $out (result (ref $A))
+      (drop
+        (br_if $out
+          (local.get $B)
+          (local.get $x)
+        )
+      )
+      (unreachable)
+    )
+  )
+
+  ;; CHECK:      (func $test-same (type $4) (param $A (ref $A)) (param $x i32) (result anyref)
+  ;; CHECK-NEXT:  (block $label$1 (result (ref $A))
+  ;; CHECK-NEXT:   (br_if $label$1
+  ;; CHECK-NEXT:    (local.get $A)
+  ;; CHECK-NEXT:    (local.get $x)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT: )
+  (func $test-same (param $A (ref $A)) (param $x i32) (result anyref)
+    ;; As above, but now we use $A everywhere, which means there is no
+    ;; difference between the type in Binaryen IR and wasm, so we do not need
+    ;; to emit any extra cast here.
+    (block $out (result (ref $A))
+      (br_if $out
+        (local.get $A)
+        (local.get $x)
+      )
+    )
+  )
+)
diff --git a/test/lit/reftypes-without-gc.wast b/test/lit/reftypes-without-gc.wast
new file mode 100644
index 000000000..e71aa5269
--- /dev/null
+++ b/test/lit/reftypes-without-gc.wast
@@ -0,0 +1,30 @@
+;; NOTE: Assertions have been generated by update_lit_checks.py and should not be edited.
+
+;; Test that we roundtrip br_if with a reference value properly if GC is not
+;; enabled. We emit a ref.cast in such cases when GC is used, but if only
+;; reference types are enabled (and not GC) then we do not need to emit a cast
+;; at all (without GC, there are no situations that require a cast anyhow). If
+;; we did emit a cast we would error here on GC not being enabled.
+
+;; RUN: wasm-opt %s --enable-reference-types --roundtrip -S -o - | filecheck %s
+
+(module
+  ;; CHECK:      (func $test (param $x i32) (result funcref)
+  ;; CHECK-NEXT:  (block $label$1 (result funcref)
+  ;; CHECK-NEXT:   (br_if $label$1
+  ;; CHECK-NEXT:    (ref.func $test)
+  ;; CHECK-NEXT:    (local.get $x)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT: )
+  (func $test (param $x i32) (result funcref)
+    (block $out (result funcref)
+      (br_if $out
+        ;; This has non-nullable type, which is more refined than the block, so
+        ;; it looks like we need to emit a cast after the br_if.
+        (ref.func $test)
+        (local.get $x)
+      )
+    )
+  )
+)