Avoid errors in Type::with(HeapType) (#7551)

Previously doing e.g. `type.with(HeapType::none)` would cause an
assertion failure if `type` was exact because `.with()` would only
replace the heap type and exact references to basic heap types are
disallowed.

Rather than checking for and avoiding this error in all the callers,
simply drop exactness when `.with()` is called with a basic heap type.
This is reasonable behavior because the only alternative is never
correct.

Add a test that hits an assertion failure without this fix.
AbstractTypeRefining replaces a defined type with `none` and the type
updating utility does not check whether the new heap type is basic
before doing the replacement.

Author: tlively

scripts/test/fuzzing.py

@@ -114,6 +114,7 @@
     'exact-references-lowering.wast',
     'exact-casts.wast',
     'exact-casts-trivial.wast',
+    'abstract-type-refining-exact.wast',
     'optimize-instructions-exact.wast',
     'optimize-instructions-all-casts.wast',
     'optimize-instructions-all-casts-exact.wast',

src/wasm-type.h

@@ -418,8 +418,12 @@ class Type {
   }
 
   // Return a new reference type with some part updated to the specified value.
+  // Always clear exactness when replacing the referenced type with a basic heap
+  // type to avoid creating an invalid type.
   Type with(HeapType heapType) const {
-    return Type(heapType, getNullability(), getExactness());
+    return Type(heapType,
+                getNullability(),
+                heapType.isBasic() ? Inexact : getExactness());
   }
   Type with(Nullability nullability) const {
     return Type(getHeapType(), nullability, getExactness());

test/lit/passes/abstract-type-refining-exact.wast

@@ -0,0 +1,18 @@
+;; NOTE: Assertions have been generated by update_lit_checks.py and should not be edited.
+
+;; RUN: wasm-opt %s -all --closed-world --abstract-type-refining -S -o - | filecheck %s
+
+(module
+ ;; CHECK:      (rec
+ ;; CHECK-NEXT:  (type $foo (struct))
+ (type $foo (struct))
+
+ ;; CHECK:      (func $test (type $1)
+ ;; CHECK-NEXT:  (local $0 (ref none))
+ ;; CHECK-NEXT: )
+ (func $test
+  ;; $foo will be replaced with none` and the exactness should be dropped
+  ;; without errors.
+  (local (ref (exact $foo)))
+ )
+)