[Custom Descriptors] CFP: Fix nullable descriptors (WebAssembly#7928)

We can write a null (it would trap, but it looks like a write in the
opt), but cannot read a null, so we must cast.

Author: kripken

src/passes/ConstantFieldPropagation.cpp

@@ -220,6 +220,15 @@ struct FunctionOptimizer : public WalkerPass<PostWalker<FunctionOptimizer>> {
 
   void visitRefGetDesc(RefGetDesc* curr) {
     optimizeRead(curr, curr->ref, StructUtils::DescriptorIndex);
+
+    // RefGetDesc has the interesting property that we can write a value into
+    // the field that cannot be read from it: it is valid to write a null, but
+    // a null can never be read (it would have trapped on the write). Fix that
+    // up as needed to not break validation.
+    if (!Type::isSubType(getCurrent()->type, curr->type)) {
+      Builder builder(*getModule());
+      replaceCurrent(builder.makeRefAs(RefAsNonNull, getCurrent()));
+    }
   }
 
   void optimizeRead(Expression* curr,
@@ -485,6 +494,10 @@ struct PCVScanner
                       Index index,
                       PossibleConstantValues& info) {
     info.note(expr, *getModule());
+    // TODO: For descriptors we can ignore nullable values that are written, as
+    //       they trap. That is, if one place writes a null and another writes a
+    //       global, only the global is readable, and we can optimize there -
+    //       the null is not a second value.
   }
 
   void noteDefault(Type fieldType,

test/lit/passes/cfp-desc.wast

@@ -403,3 +403,38 @@
   )
 )
 
+(module
+  (rec
+    ;; CHECK:      (rec
+    ;; CHECK-NEXT:  (type $A (descriptor $B (struct)))
+    (type $A (descriptor $B (struct)))
+    ;; CHECK:       (type $B (describes $A (struct)))
+    (type $B (describes $A (struct)))
+  )
+  ;; CHECK:      (type $2 (func (result (ref (exact $B)))))
+
+  ;; CHECK:      (func $test (type $2) (result (ref (exact $B)))
+  ;; CHECK-NEXT:  (ref.as_non_null
+  ;; CHECK-NEXT:   (block (result nullref)
+  ;; CHECK-NEXT:    (drop
+  ;; CHECK-NEXT:     (ref.as_non_null
+  ;; CHECK-NEXT:      (struct.new_default $A
+  ;; CHECK-NEXT:       (ref.null none)
+  ;; CHECK-NEXT:      )
+  ;; CHECK-NEXT:     )
+  ;; CHECK-NEXT:    )
+  ;; CHECK-NEXT:    (ref.null none)
+  ;; CHECK-NEXT:   )
+  ;; CHECK-NEXT:  )
+  ;; CHECK-NEXT: )
+  (func $test (result (ref (exact $B)))
+    ;; We need to add a ref.as_non_null on the descriptor that is read, as the
+    ;; function result is non-nullable.
+    (ref.get_desc $A
+      (struct.new_default $A
+        (ref.null none)
+      )
+    )
+  )
+)
+