Add StripRefiningCasts pass to eliminate redundant subtype casts and … by gkdn · Pull Request #9188 · WebAssembly/binaryen

gkdn · 2026-10-01T20:12:13Z

…null assertions

In traps-never-happen mode, values flowing into typed slots (locals, globals, call parameters, function results, struct fields, array elements, control-flow branches and fallthroughs, etc.) and the inputs of ref.test often contain downcasts or non-null assertions where the operand already statically satisfies the required type.

Such casts can narrow the value beyond the slot type, and that narrower type is information that refining passes (GUFA, signature-refining, type-refining, local-subtyping, cfp-reftest, ...) can use to refine the slot itself or to resolve a ref.test. Instead of removing them in OptimizeInstructions, which runs throughout the pipeline, add a standalone StripRefiningCasts pass (--strip-refining-casts) meant to run late in the pipeline:

Uses SubtypingDiscoverer to find all value-flowing expression slots and removes ref.cast and ref.as_non_null when the uncast value is already a subtype of all types required of that slot.
Removes ref.cast and ref.as_non_null on ref.test inputs when the outcome of the test is not determined by the input's type (otherwise leaving the test for OptimizeInstructions to resolve).
Preserves descriptor casts whose descriptor operand has side effects, and preserves casts on arguments to call.without.effects (which must match the parameters of the actual target rather than those of the intrinsic import).

…null assertions In traps-never-happen mode, values flowing into typed slots (call / call_ref / call_indirect arguments, returned values, stored locals/globals, struct and array field/element writes, new allocations, select arms) and the inputs of ref.test often contain downcasts or non-null assertions where the operand already statically satisfies the slot type. Such casts can narrow the value beyond the slot type, and that narrower type is information that refining passes (GUFA, signature-refining, type-refining, local-subtyping, cfp-reftest, ...) can use to refine the slot itself or to resolve a ref.test. Instead of removing them in OptimizeInstructions, which runs throughout the pipeline, add a standalone StripRefiningCasts pass (--strip-refining-casts) meant to run late in the pipeline: - Removes ref.cast and ref.as_non_null on call / call_ref / call_indirect parameters, function results, locals (non-tee), globals, struct.new / struct.set fields, array.new / array.new_fixed / array.set elements, and select arms when the uncast value is already a subtype of the slot type. - Removes ref.cast and ref.as_non_null on ref.test inputs when the outcome of the test is not determined by the input's type (otherwise leaving the test for OptimizeInstructions to resolve). - Preserves descriptor casts and casts on arguments to call.without.effects (which must match the parameters of the actual target rather than those of the intrinsic import).

kripken · 2026-10-01T22:21:49Z

+  }
+
+  void skipCastsOnOperands(ExpressionList& operands, Type params) {
+    if (params.size() != operands.size()) {


How can this happen?

Yeah, I think this can be an assertion.

kripken · 2026-10-01T22:24:51Z

+  }
+
+  void visitGlobalSet(GlobalSet* curr) {
+    skipCasts(curr->value, getModule()->getGlobal(curr->name)->type);


It looks like these duplicate logic from src/ir/subtype-exprs.h, e.g.

void visitGlobalSet(GlobalSet* curr) { self()->noteSubtype(curr->value, self()->getModule()->getGlobal(curr->name)->type); }

Can we instead use that code, implementing a noteSubtype callback that gives us the type of the slot, which is what we need?

tlively

The suggested improvements can just be TODO comments.

Running scripts/experimental/coverage-diff.py shows some missing edge cases in the tests that would be worth fixing.

tlively · 2026-10-01T20:27:02Z

+        // Removing a descriptor cast would also remove the descriptor operand,
+        // along with its side effects.


This can be worked around by using ChildLocalizer::getChildrenReplacement to get a Block containing the children, then appending cast->ref to the end of the block (where ChildLocalizer will have updated cast->ref to be a LocalGet of a scratch local if necessary). Then the cast can be replaced with the Block.

tlively · 2026-10-01T20:32:42Z

+
+  // Skips casts on |input| while the uncast value is a subtype of |slotType|.
+  void skipCasts(Expression*& input, Type slotType) {
+    while (1) {


This loop could also look through "fallthrough expressions" like blocks, loops, br_if, local.tee, etc. using Properties::getImmediateFallthroughPtr.

tlively · 2026-10-01T20:36:45Z

+    }
+  }
+
+  void visitSelect(Select* curr) {


We could even have skipCasts look through both sides of a select (or If, or Try-Catch) and remove casts on all of the joined arms.

tlively · 2026-10-01T22:53:16Z

+  }
+
+  void skipCastsOnOperands(ExpressionList& operands, Type params) {
+    if (params.size() != operands.size()) {


Yeah, I think this can be an assertion.

tlively · 2026-10-01T22:54:07Z

+  }
+
+  void visitCallRef(CallRef* curr) {
+    if (curr->target->type.isSignature()) {


It doesn't look like this is covered by the tests.

tlively · 2026-10-01T22:54:20Z

+  }
+
+  void visitCallIndirect(CallIndirect* curr) {
+    if (curr->heapType.isSignature()) {


I think this can also be an assertion.

…fects

kripken

Nice!

lgtn with some last comments. Also

Please add this pass to scripts/fuzz_opt.py around line 2760, so it gets fuzzed.

kripken · 2026-10-01T23:38:26Z

+    for (auto& [slot, type] : requiredTypes) {
+      skipCasts(*slot, type);
+    }
+    requiredTypes.clear();


No need for manual cleanup in a function-parallel pass.

Suggested change

requiredTypes.clear();

kripken · 2026-10-01T23:46:37Z

Really cool how SubtypingDiscoverer gives us all the core logic here!

tlively · 2026-10-02T00:11:04Z

+        (local.get $ns)
+      )
+    )
+    ;; A local.tee's type is the type of the local, so its cast is also removed.


This is not true in Binaryen IR. (We fix things up in the binary writer in cases where it could cause problems.)

Just double checking before taking action since agent claims otherwise and I don't know any better:

In Binaryen IR, local.tee actually does have the type of the local (FunctionValidator::visitLocalSet enforces curr->type == getFunction()->getLocalType(curr->index)). I think you might be thinking of br_if, which has the type of its value operand in Binaryen IR and gets fixed up in BinaryInstWriter::visitBreak.

This is something we went back and forth on iirc, so maybe it is confusing, but we use the wasm spec type here. So the tee type is the type of the local (which is not ideal).

Code:

binaryen/src/wasm/wasm-ir-builder.cpp

Line 1603 in f3ab996

push(builder.makeLocalTee(local, curr.value, func->getLocalType(local)));

Oh yes, I was confused. It's a little weird that we follow the spec for tee but not br_if.

tlively · 2026-10-02T00:16:00Z

+    ;; while br_if keeps its cast because the br_if's own result type is the
+    ;; cast type.


The result for br_if could be improved if we optimized through fallthrough expressions.

tlively

LGTM if the fuzzer is happy.

gkdn requested a review from a team as a code owner October 1, 2026 20:12

gkdn requested review from tlively and removed request for a team October 1, 2026 20:12

kripken reviewed Oct 1, 2026

View reviewed changes

tlively reviewed Oct 1, 2026

View reviewed changes

Use SubtypingDiscoverer in StripRefiningCasts and check descriptor ef…

445fbcb

…fects

kripken reviewed Oct 1, 2026

View reviewed changes

tlively reviewed Oct 2, 2026

View reviewed changes

gkdn added 2 commits October 1, 2026 23:43

Address review feedback on StripRefiningCasts

8229a1c

Restore unreachable test cases in strip-refining-casts.wast

06b9e1b

tlively approved these changes Oct 2, 2026

View reviewed changes

		// Removing a descriptor cast would also remove the descriptor operand,
		// along with its side effects.

		;; while br_if keeps its cast because the br_if's own result type is the
		;; cast type.

Conversation

gkdn commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tlively left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kripken left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kripken commented Oct 1, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tlively left a comment

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

gkdn commented Oct 1, 2026 •

edited

Loading