[Wasm GC] Fix GUFA on trampled params in TrapsNeverHappens mode (#7368)

GUFA in TNH mode will infer that this will trap:

(func $foo (param $x)
  (ref.cast $T (local.get $x))
)

(func $bar
  (call $foo (X))
)

If X's type will cause a trap when cast to T, then we infer that the call
will trap, and optimize. However, we were missing a check for the
param being trampled,

(func $foo (param $x)
  (local.set $x (Y))     ;; !!!!!!!!!!
  (ref.cast $T (local.get $x))
)

Then if Y can be cast, we should not actually trap.

Fix this by just tracking which params are written to. We only look
in the first basic block anyhow, and traverse it in order, so that is
enough.

Fixes #7366

Author: kripken

src/ir/possible-contents.cpp

@@ -1545,6 +1545,22 @@ void TNHOracle::scan(Function* func,
       self->inEntryBlock = false;
     }
 
+    // We note params that are written to, as local changes prevent us from
+    // inferences:
+    //
+    //  (func $foo (param $x)
+    //    (local.set $x ..)
+    //    (ref.cast (local.get $x)) ;; this is no longer casting the actual
+    //                              ;; parameter
+    //
+    std::unordered_set<Index> writtenParams;
+
+    void visitLocalSet(LocalSet* curr) {
+      if (getFunction()->isParam(curr->index)) {
+        writtenParams.insert(curr->index);
+      }
+    }
+
     void visitCall(Call* curr) { info.calls.push_back(curr); }
 
     void visitCallRef(CallRef* curr) {
@@ -1570,13 +1586,15 @@ void TNHOracle::scan(Function* func,
 
       auto* fallthrough = Properties::getFallthrough(expr, options, wasm);
       if (auto* get = fallthrough->dynCast<LocalGet>()) {
-        // To optimize, this needs to be a param, and of a useful type.
+        // To optimize, this needs to be an unmodified param, and of a useful
+        // type.
         //
         // Note that if we see more than one cast we keep the first one. This is
         // not important in optimized code, as the most refined cast would be
         // the only one to exist there, so it's ok to keep things simple here.
         if (getFunction()->isParam(get->index) && type != get->type &&
-            info.castParams.count(get->index) == 0) {
+            info.castParams.count(get->index) == 0 &&
+            !writtenParams.count(get->index)) {
           info.castParams[get->index] = type;
         }
       }

test/lit/passes/gufa-tnh.wast

@@ -2063,3 +2063,76 @@
   )
  )
 )
+
+;; Test writes to locals that interfere with inferences about casts.
+(module
+ (rec
+  ;; CHECK:      (rec
+  ;; CHECK-NEXT:  (type $top (sub (struct)))
+  (type $top (sub (struct)))
+  ;; CHECK:       (type $bot (sub $top (struct)))
+  (type $bot (sub $top (struct)))
+ )
+
+ ;; CHECK:      (type $2 (func (param (ref $top))))
+
+ ;; CHECK:      (type $3 (func (param (ref extern))))
+
+ ;; CHECK:      (export "$invokeMain" (func $invokeMain))
+
+ ;; CHECK:      (func $main-set (type $2) (param $0 (ref $top))
+ ;; CHECK-NEXT:  (local.set $0
+ ;; CHECK-NEXT:   (struct.new_default $bot)
+ ;; CHECK-NEXT:  )
+ ;; CHECK-NEXT:  (drop
+ ;; CHECK-NEXT:   (ref.cast (ref $bot)
+ ;; CHECK-NEXT:    (local.get $0)
+ ;; CHECK-NEXT:   )
+ ;; CHECK-NEXT:  )
+ ;; CHECK-NEXT: )
+ (func $main-set (param (ref $top))
+  ;; We receive a top as input, but write a bot to it, trampling the ignored
+  ;; parameter. Thanks to the trampling, the cast below will succeed, and so we
+  ;; should not make anything unreachable in the caller - nothing traps here.
+  (local.set 0
+   (struct.new $bot)
+  )
+  (drop
+   (ref.cast (ref $bot)
+    (local.get 0)
+   )
+  )
+ )
+
+ ;; CHECK:      (func $main-noset (type $2) (param $0 (ref $top))
+ ;; CHECK-NEXT:  (drop
+ ;; CHECK-NEXT:   (unreachable)
+ ;; CHECK-NEXT:  )
+ ;; CHECK-NEXT: )
+ (func $main-noset (param (ref $top))
+  ;; As above, but without the local.set. Here we will trap, so the caller can
+  ;; optimize to unreachable.
+  (drop
+   (ref.cast (ref $bot)
+    (local.get 0)
+   )
+  )
+ )
+
+ ;; CHECK:      (func $invokeMain (type $3) (param $0 (ref extern))
+ ;; CHECK-NEXT:  (call $main-set
+ ;; CHECK-NEXT:   (struct.new_default $top)
+ ;; CHECK-NEXT:  )
+ ;; CHECK-NEXT:  (call $main-noset
+ ;; CHECK-NEXT:   (unreachable)
+ ;; CHECK-NEXT:  )
+ ;; CHECK-NEXT: )
+ (func $invokeMain (export "$invokeMain") (param (ref extern))
+  (call $main-set
+   (struct.new $top)
+  )
+  (call $main-noset
+   (struct.new $top)
+  )
+ )
+)