Incorrect `ref.test` result

[apoorvaanand1998]

(module
    (type $appNode 
        (struct (field $left anyref)
                (field $right anyref)))
    
    (type $comb (struct (field $asciiTag i32)))

    (func $prob1 (export "prob1") (param $p (ref null $appNode)) (result i32)
        (local.get $p)
        (struct.get $appNode $left)
        (ref.cast (ref null $appNode))
        (struct.get $appNode $right)
        (ref.test (ref null $comb))
    )

    (func $prob2 (export "prob2") (param $p (ref null $appNode)) (result i32)
        (local.get $p)
        (struct.get $appNode $left)
        (ref.cast (ref null $appNode))
        (struct.get $appNode $left)
        (ref.test (ref null $comb))
    )

    (func $main (export "main") (result i32)
        (struct.new $appNode (struct.new $appNode (struct.new $comb (i32.const 67))
                                                  (struct.new $comb (i32.const 73)))
                             (ref.i31 (i32.const 2)))
        (call $prob2)                             
    )
)

Hey Wasmtime team! calling $prob1 returns 1 but $prob2 returns 0. Why is that? Shouldn't it be reading the (struct.new $comb (i32.const 67)) which indeed is a comb? I've tried reading the GC spec but haven't been able to figure out why the runtime behaves this way.

[fitzgen]

This looks like a bug in Wasmtime, I think prob2 should indeed return 1.

FWIW, it also returns 1 in Firefox.

[fitzgen]

Interestingly enough, removing $right makes the test pass.

[fitzgen]

Haven't managed to meaningfully reduce it past this:

(module
  (type $tree (struct (field $left anyref)
                      (field $right anyref)))
  (type $s (struct))
  (func (export "main") (result i32)
    (struct.new $tree
                (struct.new $tree
                            (struct.new $s)
                            (ref.i31 (i32.const 1)))
                (ref.i31 (i32.const 2)))
    struct.get $tree $left
    ref.cast (ref null $tree)
    struct.get $tree $left
    ref.test (ref null $s)
  )
)

Interestingly, changing $right to be an i31ref also makes the test pass.

[fitzgen]

And removing one layer of tree nesting also makes the test pass.

[fitzgen]

Using the null collector instead of the DRC collector also makes the test pass. I'm starting to suspect that this involves a Wasm-to-CLIF translation bug where we are accidentally generating CLIF that is more optimizable than it should be.

[fitzgen]

FWIW, here is the flattened version of the test case, which makes the order of instructions a little easier to read when staring at clif and comparing it to the original wasm:

(module
  (type $tree (struct (field $left anyref)
                      (field $right anyref)))
  (type $s (struct))
  (func (export "main") (result i32)
    struct.new $s
    ref.null i31
    struct.new $tree
    i32.const 2
    ref.i31
    struct.new $tree
    struct.get $tree $left
    ref.cast (ref null $tree)
    struct.get $tree $left
    ref.test (ref null $s)
  )
)