Reboot TypeGeneralizing to use ChildTyper

scripts/test/fuzzing.py

@@ -22,6 +22,7 @@
     'strings.wast',
     'simplify-locals-strings.wast',
     'string-lowering-instructions.wast',
+    'type-generalizing-strings.wast',
     # TODO: fuzzer and interpreter support for extern conversions
     'extern-conversions.wast',
     # ignore DWARF because it is incompatible with multivalue atm

src/ir/child-typer.h

@@ -862,7 +862,9 @@ template<typename Subtype> struct ChildTyper : OverriddenVisitor<Subtype> {
   void visitRefI31(RefI31* curr) { note(&curr->value, Type::i32); }
 
   void visitI31Get(I31Get* curr) {
-    note(&curr->i31, Type(HeapType::i31, Nullable));
+    // Polymorphic over sharedness.
+    note(&curr->i31,
+         VarRef{Nullable, VarAbsHeapType{VarSharedness{0u}, HeapType::i31}});
   }
 
   void visitCallRef(CallRef* curr, std::optional<HeapType> ht = std::nullopt) {
@@ -973,7 +975,7 @@ template<typename Subtype> struct ChildTyper : OverriddenVisitor<Subtype> {
       }
     }
     if (auto desc = curr->type.getHeapType().getDescriptorType()) {
-      note(&curr->desc, Type(*desc, NonNullable, Exact));
+      note(&curr->desc, Type(*desc, Nullable, Exact));
     }
   }
 
@@ -1167,7 +1169,9 @@ template<typename Subtype> struct ChildTyper : OverriddenVisitor<Subtype> {
   }
 
   void visitArrayLen(ArrayLen* curr) {
-    note(&curr->ref, Type(HeapType::array, Nullable));
+    // Polymorphic over sharedness.
+    note(&curr->ref,
+         VarRef{Nullable, VarAbsHeapType{VarSharedness{0u}, HeapType::array}});
   }
 
   void visitArrayCopy(ArrayCopy* curr,

src/passes/OptimizeInstructions.cpp

@@ -1576,6 +1576,9 @@ struct OptimizeInstructions
   //    Given the large amount of potential benefit we can get from a successful
   //    optimization in GUFA, any reduction there may be a bad idea, so we
   //    should be very careful and probably *not* remove such casts.
+  //
+  // The only case where we are always ok to remove such casts is when lastOpts
+  // is true, because nothing significant runs after us that can be harmed.
 
   // If an instruction traps on a null input, there is no need for a
   // ref.as_non_null on that input: we will trap either way (and the binaryen