Reboot TypeGeneralizing to use SubtypingDiscoverer

src/ir/subtype-exprs.h

@@ -252,7 +252,10 @@ struct SubtypingDiscoverer : public OverriddenVisitor<SubType> {
                         self()->getModule()->getTable(curr->table)->type);
   }
   void visitTableSize(TableSize* curr) {}
-  void visitTableGrow(TableGrow* curr) {}
+  void visitTableGrow(TableGrow* curr) {
+    self()->noteSubtype(curr->value,
+                        self()->getModule()->getTable(curr->table)->type);
+  }
   void visitTableFill(TableFill* curr) {
     self()->noteSubtype(curr->value,
                         self()->getModule()->getTable(curr->table)->type);
@@ -288,8 +291,18 @@ struct SubtypingDiscoverer : public OverriddenVisitor<SubType> {
     }
   }
   void visitRethrow(Rethrow* curr) {}
-  void visitThrowRef(ThrowRef* curr) {}
-  void visitTupleMake(TupleMake* curr) {}
+  void visitThrowRef(ThrowRef* curr) {
+    self()->noteNonFlowSubtype(curr->exnref, Type(HeapType::exn, Nullable));
+  }
+  void visitTupleMake(TupleMake* curr) {
+    if (curr->type != Type::unreachable) {
+      assert(curr->operands.size() == curr->type.size());
+      // Ensure the inputs make sense for the tuple.
+      for (size_t i = 0, size = curr->operands.size(); i < size; ++i) {
+        self()->noteSubtype(curr->operands[i], curr->type[i]);
+      }
+    }
+  }
   void visitTupleExtract(TupleExtract* curr) {}
   void visitRefI31(RefI31* curr) {}
   void visitI31Get(I31Get* curr) {
@@ -330,31 +343,86 @@ struct SubtypingDiscoverer : public OverriddenVisitor<SubType> {
   void visitRefTest(RefTest* curr) {
     self()->noteCast(curr->ref, curr->castType);
   }
-  void visitRefCast(RefCast* curr) { self()->noteCast(curr->ref, curr); }
-  void visitRefGetDesc(RefGetDesc* curr) {}
+  void visitRefCast(RefCast* curr) {
+    self()->noteCast(curr->ref, curr);
+
+    if (curr->desc) {
+      // As with CallRef, we must keep a descriptor valid: it must be a declared
+      // descriptor type. Until we have addStructSubtype, make it keep its type.
+      self()->noteSubtype(curr->desc, curr->desc->type);
+    }
+  }
+  void visitRefGetDesc(RefGetDesc* curr) {
+    // Similar to RefCastDesc, we must keep the input a valid struct type, one
+    // with a descriptor. Until we have addStructSubtype or such, make it keep
+    // its type.
+    self()->noteSubtype(curr->ref, curr->ref->type);
+  }
   void visitBrOn(BrOn* curr) {
+    auto* breakTarget = self()->findBreakTarget(curr->name);
     switch (curr->op) {
       case BrOnNull:
+        // If we do not branch, we flow out the existing value as non-null.
+        if (curr->type.isRef()) {
+          self()->noteSubtype(curr->ref, curr->type.with(Nullable));
+        }
+        break;
       case BrOnNonNull:
+        // The value sent is made non-nullable and then sent. That means it
+        // must have the right heap type.
+        if (breakTarget->type.isRef()) {
+          // Enforce the heap type requirement by making sure we are a subtype
+          // of the target, made nullable (i.e., without any non-nullability
+          // requirement, as we are making it non-nullable anyhow).
+          self()->noteSubtype(curr->ref, breakTarget->type.with(Nullable));
+        }
         break;
       case BrOnCast:
       case BrOnCastFail:
       case BrOnCastDescEq:
       case BrOnCastDescEqFail:
         self()->noteCast(curr->ref, curr->castType);
+        if (curr->desc) {
+          // As with RefCast, we must keep a descriptor valid.
+          self()->noteSubtype(curr->desc, curr->desc->type);
+        }
+        if (curr->op == BrOnCast || curr->op == BrOnCastDescEq) {
+          // If we do not branch, we flow out the original input when the cast
+          // fails. If the cast type is nullable then nulls take the branch, so
+          // the fallthrough value is made non-nullable.
+          if (curr->type.isRef()) {
+            auto type = curr->type;
+            if (curr->castType.isNullableRef()) {
+              type = type.with(Nullable);
+            }
+            self()->noteSubtype(curr->ref, type);
+          }
+        } else {
+          // We send the original input along when the cast fails, so the input
+          // must be sendable to the target.
+          if (breakTarget->type.isRef()) {
+            self()->noteSubtype(curr->ref, breakTarget->type);
+          }
+        }
         break;
     }
-    self()->noteSubtype(curr->getSentType(),
-                        self()->findBreakTarget(curr->name));
+    self()->noteSubtype(curr->getSentType(), breakTarget);
   }
   void visitStructNew(StructNew* curr) {
-    if (!curr->type.isStruct() || curr->isWithDefault()) {
+    if (!curr->type.isStruct()) {
       return;
     }
-    const auto& fields = curr->type.getHeapType().getStruct().fields;
-    assert(fields.size() == curr->operands.size());
-    for (size_t i = 0, size = fields.size(); i < size; ++i) {
-      self()->noteSubtype(curr->operands[i], fields[i].type);
+    if (!curr->isWithDefault()) {
+      const auto& fields = curr->type.getHeapType().getStruct().fields;
+      assert(fields.size() == curr->operands.size());
+      for (size_t i = 0, size = fields.size(); i < size; ++i) {
+        self()->noteSubtype(curr->operands[i], fields[i].type);
+      }
+    }
+    if (curr->desc) {
+      auto descType = curr->type.getHeapType().getDescriptorType();
+      assert(descType);
+      self()->noteSubtype(curr->desc, Type(*descType, Nullable, Exact));
     }
   }
   void visitStructGet(StructGet* curr) {}
@@ -404,7 +472,7 @@ struct SubtypingDiscoverer : public OverriddenVisitor<SubType> {
     self()->noteSubtype(curr->waitqueue,
                         Type(HeapTypes::sharedWaitqueue, Nullable));
   }
-  void visitPublish(Publish* curr) {}
+  void visitPublish(Publish* curr) { self()->noteSubtype(curr->ref, curr); }
   void visitArrayNew(ArrayNew* curr) {
     if (!curr->type.isArray() || curr->isWithDefault()) {
       return;
@@ -441,7 +509,14 @@ struct SubtypingDiscoverer : public OverriddenVisitor<SubType> {
   }
   void visitArrayLoad(ArrayLoad* curr) {}
   void visitArrayStore(ArrayStore* curr) {}
-  void visitArrayLen(ArrayLen* curr) {}
+  void visitArrayLen(ArrayLen* curr) {
+    auto share = Unshared;
+    if (curr->ref->type.isRef() && curr->ref->type.getHeapType().isShared()) {
+      share = Shared;
+    }
+    self()->noteNonFlowSubtype(
+      curr->ref, Type(HeapTypes::array.getBasic(share), Nullable));
+  }
   void visitArrayCopy(ArrayCopy* curr) {
     if (!curr->srcRef->type.isArray() || !curr->destRef->type.isArray()) {
       return;
@@ -513,24 +588,64 @@ struct SubtypingDiscoverer : public OverriddenVisitor<SubType> {
         return;
     }
   }
-  void visitStringNew(StringNew* curr) {}
+  void visitStringNew(StringNew* curr) {
+    switch (curr->op) {
+      case StringNewLossyUTF8Array:
+        self()->noteNonFlowSubtype(curr->ref,
+                                   Type(HeapTypes::getMutI8Array(), Nullable));
+        break;
+      case StringNewWTF16Array:
+        self()->noteNonFlowSubtype(curr->ref,
+                                   Type(HeapTypes::getMutI16Array(), Nullable));
+        break;
+      case StringNewFromCodePoint:
+        break;
+    }
+  }
   void visitStringConst(StringConst* curr) {}
-  void visitStringMeasure(StringMeasure* curr) {}
-  void visitStringEncode(StringEncode* curr) {}
-  void visitStringConcat(StringConcat* curr) {}
-  void visitStringEq(StringEq* curr) {}
-  void visitStringTest(StringTest* curr) {}
-  void visitStringWTF16Get(StringWTF16Get* curr) {}
-  void visitStringSliceWTF(StringSliceWTF* curr) {}
+  void visitStringMeasure(StringMeasure* curr) {
+    self()->noteNonFlowSubtype(curr->ref, Type(HeapType::string, Nullable));
+  }
+  void visitStringEncode(StringEncode* curr) {
+    self()->noteNonFlowSubtype(curr->str, Type(HeapType::string, Nullable));
+    switch (curr->op) {
+      case StringEncodeLossyUTF8Array:
+        self()->noteNonFlowSubtype(curr->array,
+                                   Type(HeapTypes::getMutI8Array(), Nullable));
+        break;
+      case StringEncodeWTF16Array:
+        self()->noteNonFlowSubtype(curr->array,
+                                   Type(HeapTypes::getMutI16Array(), Nullable));
+        break;
+    }
+  }
+  void visitStringConcat(StringConcat* curr) {
+    self()->noteNonFlowSubtype(curr->left, Type(HeapType::string, Nullable));
+    self()->noteNonFlowSubtype(curr->right, Type(HeapType::string, Nullable));
+  }
+  void visitStringEq(StringEq* curr) {
+    self()->noteNonFlowSubtype(curr->left, Type(HeapType::string, Nullable));
+    self()->noteNonFlowSubtype(curr->right, Type(HeapType::string, Nullable));
+  }
+  void visitStringTest(StringTest* curr) {
+    self()->noteNonFlowSubtype(curr->ref, Type(HeapType::ext, Nullable));
+  }
+  void visitStringWTF16Get(StringWTF16Get* curr) {
+    self()->noteNonFlowSubtype(curr->ref, Type(HeapType::string, Nullable));
+  }
+  void visitStringSliceWTF(StringSliceWTF* curr) {
+    self()->noteNonFlowSubtype(curr->ref, Type(HeapType::string, Nullable));
+  }
 
   void visitContNew(ContNew* curr) {
     if (!curr->type.isContinuation()) {
       return;
     }
     // The type of the function reference must remain a subtype of the function
     // type expected by the continuation.
-    self()->noteSubtype(curr->func->type.getHeapType(),
-                        curr->type.getHeapType().getContinuation().type);
+    self()->noteSubtype(
+      curr->func,
+      Type(curr->type.getHeapType().getContinuation().type, Nullable));
   }
   void visitContBind(ContBind* curr) {
     if (!curr->cont->type.isContinuation() || !curr->type.isContinuation()) {
@@ -602,6 +717,11 @@ struct SubtypingDiscoverer : public OverriddenVisitor<SubType> {
     if (!curr->cont->type.isContinuation()) {
       return;
     }
+
+    // Like CallRef, we cannot generalize the ref into a basic type, it must
+    // here remain a Continuation.
+    self()->noteSubtype(curr->cont, curr->cont->type);
+
     processResumeHandlers(
       curr->cont->type, curr->handlerTags, curr->handlerBlocks);
     // The types we send to the resumed continuation must remain subtypes of the
@@ -631,6 +751,10 @@ struct SubtypingDiscoverer : public OverriddenVisitor<SubType> {
       for (Index i = 0; i < curr->operands.size(); ++i) {
         self()->noteSubtype(curr->operands[i], params[i]);
       }
+    } else {
+      assert(curr->operands.size() == 1);
+      self()->noteNonFlowSubtype(curr->operands[0],
+                                 Type(HeapType::exn, Nullable));
     }
   }
   void visitStackSwitch(StackSwitch* curr) {

src/passes/OptimizeInstructions.cpp

@@ -1590,6 +1590,9 @@ struct OptimizeInstructions
   //    Given the large amount of potential benefit we can get from a successful
   //    optimization in GUFA, any reduction there may be a bad idea, so we
   //    should be very careful and probably *not* remove such casts.
+  //
+  // The only case where we are always ok to remove such casts is when lastOpts
+  // is true, because nothing significant runs after us that can be harmed.
 
   // If an instruction traps on a null input, there is no need for a
   // ref.as_non_null on that input: we will trap either way (and the binaryen