Add multiple tables support for WebAssembly and update CFI implementation

[ddcc]

Summary

This patch adds support for multiple tables to WebAssembly, and updates the CFI implementation to place each disjoint call set into a unique WebAssembly indirect call table with homogeneous element type.

Unfortunately, the current approach is fairly hacky, and likely won't be in a state that is ready to be merged before I leave. One problem that I've encountered in general with CFI has been with pointer casts:

In C, pointer types are often casted in order to implement features such as generic callbacks and object polymorphism. But these will have different type metadata at the function definition and the call site, and fail to match up. For example, the standard library qsort() definitions a callback comparison function with type int (*compare)(const void*, const void*). But when implementing such a comparison function, it will typically have a more specific type, e.g. int compare_parse(Linkage_info* a, Linkage_info* b).

With this specific implementation in particular, there are some additional problems:

1. There is no direct link from the call to the llvm.type.test() to the actual indirect call site. But I need to tag the indirect call so that it references the correct indirect call table in WebAssembly, so the current approach performs a restricted level-ordered search from the type test up to sibling uses of each parent node, which is mostly correct but fairly slow.

2. Metadata is used to tag the call site with the destination indirect call table in WebAssembly. But this is very brittle, because the program should still be correct if the metadata is removed. However, this is currently not true. First, if there is no metadata present at an indirect call site, the backend assumes that the default indirect call table should be used, because indirect calls generated by the compiler for C++ vtable references have no call table tag. Additionally, if there is type metadata that is present at an indirect call site, but the program does not contain any functions with this type, then these call sites will not be tagged; this is usually caused by unreachable/dead code. Secondly, if the indirect call site is tagged but subsequently modified by a compiler optimization/transform, then it may lose the call table tag, which is incorrect.

[ddcc]

Attempt to add backend wasm table operand

[ddcc]

More context

[ddcc]

Fix TableGen, update tests

[ddcc]

Rebase

[ddcc]

Rebase

[dschuff]

is the intention that the multiple table support replaces the implementation on top of MVP features? I don't see any way to make it conditional.

[ddcc]

Yes, I was thinking to add multiple support in the backend, but leave it disabled in the assembler/linker. Then, for the MVP, s2wasm would produce an error if non-default table references are encountered. But I can change the implementation if there's a better way to do this.

[ddcc]

Rebase

[ddcc]

Fix bug with direct call generation

[ddcc]

Fix bug with multiple uses of one type check result

[ddcc]

Fix bugs with C++ and invoke instructions

[ddcc]

Replace heuristics with slow but more correct iterative search

[ddcc]

Refactoring, handle more cases

[ddcc]

Final prototype for testing

lib/Target/WebAssembly/Disassembler/WebAssemblyDisassembler.cpp

if (Desc.isVariadic()) {
     Pos += sizeof(uint64_t);
   }
 
   // Read the fixed operands. These are described by the MCInstrDesc.
   for (unsigned i = 0; i < NumFixedOperands; ++i) {
     const MCOperandInfo &Info = Desc.OpInfo[i];
     switch (Info.OperandType) {
     case MCOI::OPERAND_IMMEDIATE:
+    case WebAssembly::OPERAND_TABLE:
     case WebAssembly::OPERAND_P2ALIGN:
     case WebAssembly::OPERAND_BASIC_BLOCK: {
       if (Pos + sizeof(uint64_t) > Bytes.size())
         return MCDisassembler::Fail;
       uint64_t Imm = support::endian::read64le(Bytes.data() + Pos);
       Pos += sizeof(uint64_t);
       MI.addOperand(MCOperand::createImm(Imm));
       break;

lib/Target/WebAssembly/MCTargetDesc/WebAssemblyMCTargetDesc.h

 enum OperandType {
   /// Basic block label in a branch construct.
   OPERAND_BASIC_BLOCK = MCOI::OPERAND_FIRST_TARGET,
   /// 32-bit floating-point immediates.
   OPERAND_FP32IMM,
   /// 64-bit floating-point immediates.
   OPERAND_FP64IMM,
   /// p2align immediate for load and store address alignment.
-  OPERAND_P2ALIGN
+  OPERAND_P2ALIGN,
+  /// table immediate to specify which indirect call table to use.
+  OPERAND_TABLE
 };
 
 /// WebAssembly-specific directive identifiers.
 enum Directive {
   // FIXME: This is not the real binary encoding.
   DotParam = UINT64_MAX - 0,   ///< .param
   DotResult = UINT64_MAX - 1,  ///< .result
   DotLocal = UINT64_MAX - 2,   ///< .local

lib/Target/WebAssembly/WebAssemblyFastISel.cpp

for (unsigned i = 0, e = Call->getNumArgOperands(); i < e; ++i) {
     Args.push_back(Reg);
   }
 
   auto MIB = BuildMI(*FuncInfo.MBB, FuncInfo.InsertPt, DbgLoc, TII.get(Opc));
 
   if (!IsVoid)
     MIB.addReg(ResultReg, RegState::Define);
 
+  // Add the table operand, default to zero
+  if (!IsDirect) {
+    if (MDNode *MD = Call->getMetadata("wasm.index"))
+      MIB.addImm(cast<ConstantAsMetadata>(MD->getOperand(0))
+               ->getValue()
+               ->getUniqueInteger()
+               .getSExtValue());
+    else
+      MIB.addImm(0);
+  }
+
   if (IsDirect)
     MIB.addGlobalAddress(Func);
   else
     MIB.addReg(getRegForValue(Call->getCalledValue()));
 
   for (unsigned ArgReg : Args)
     MIB.addReg(ArgReg);
 
bool WebAssemblyFastISel::selectBr(const Instruction *I) {
 
   unsigned Opc = WebAssembly::BR_IF;
   if (Not)
     Opc = WebAssembly::BR_UNLESS;
 
   BuildMI(*FuncInfo.MBB, FuncInfo.InsertPt, DbgLoc, TII.get(Opc))
       .addMBB(TBB)
       .addReg(CondReg);
-  
   finishCondBranch(Br->getParent(), TBB, FBB);
   return true;
 }
 
 bool WebAssemblyFastISel::selectRet(const Instruction *I) {
   if (!FuncInfo.CanLowerReturn)
     return false;
 

lib/Target/WebAssembly/WebAssemblyISelLowering.cpp

if (IsVarArg && NumBytes) {
     if (!Chains.empty())
       Chain = DAG.getNode(ISD::TokenFactor, DL, MVT::Other, Chains);
   } else if (IsVarArg) {
     FINode = DAG.getIntPtrConstant(0, DL);
   }
 
   // Compute the operands for the CALLn node.
   SmallVector<SDValue, 16> Ops;
+  // Add the indirect call table operand, default to zero
+  APInt TableOp;
   Ops.push_back(Chain);
+  if (CLI.CS && !CLI.CS->getCalledFunction()) {
+    if (MDNode *MD = CLI.CS->getInstruction()->getMetadata("wasm.index")) {
+      TableOp = cast<ConstantAsMetadata>(MD->getOperand(0))
+              ->getValue()
+              ->getUniqueInteger();
+    } else {
+      TableOp = APInt::getNullValue(64);
+    }
+    Ops.push_back(DAG.getConstant(TableOp, DL, MVT::i64));
+  }
   Ops.push_back(Callee);
 
   // Add all fixed arguments. Note that for non-varargs calls, NumFixedArgs
   // isn't reliable.
   Ops.append(OutVals.begin(),
              IsVarArg ? OutVals.begin() + NumFixedArgs : OutVals.end());
   // Add a pointer to the vararg buffer.
   if (IsVarArg) Ops.push_back(FINode);

lib/Target/WebAssembly/WebAssemblyInstrCall.td

 def ADJCALLSTACKUP : I<(outs), (ins i32imm:$amt, i32imm:$amt2),
                        [(WebAssemblycallseq_end timm:$amt, timm:$amt2)]>;
 } // isCodeGenOnly = 1
 
 multiclass CALL<WebAssemblyRegClass vt, string prefix> {
   def CALL_#vt : I<(outs vt:$dst), (ins i32imm:$callee, variable_ops),
                    [(set vt:$dst, (WebAssemblycall1 (i32 imm:$callee)))],
                    !strconcat(prefix, "call\t$dst, $callee")>;
-  def CALL_INDIRECT_#vt : I<(outs vt:$dst), (ins I32:$callee, variable_ops),
-                            [(set vt:$dst, (WebAssemblycall1 I32:$callee))],
-                            !strconcat(prefix, "call_indirect\t$dst, $callee")>;
+  def CALL_INDIRECT_#vt : I<(outs vt:$dst),
+                            (ins table_op:$table, I32:$callee, variable_ops),
+                            [(set vt:$dst, (WebAssemblycall1 imm:$table, I32:$callee))],
+                            !strconcat(prefix, "call_indirect.$table\t$dst, $callee")>;
 }
 let Uses = [SP32, SP64], isCall = 1 in {
   defm : CALL<I32, "i32.">;
   defm : CALL<I64, "i64.">;
   defm : CALL<F32, "f32.">;
   defm : CALL<F64, "f64.">;
 
   def CALL_VOID : I<(outs), (ins i32imm:$callee, variable_ops),
                     [(WebAssemblycall0 (i32 imm:$callee))],
-                    "call    \t$callee">;
-  def CALL_INDIRECT_VOID : I<(outs), (ins I32:$callee, variable_ops),
-                             [(WebAssemblycall0 I32:$callee)],
-                             "call_indirect\t$callee">;
+                    "call\t$callee">;
+  def CALL_INDIRECT_VOID : I<(outs),
+                             (ins table_op:$table, I32:$callee, variable_ops),
+                             [(WebAssemblycall0 imm:$table, I32:$callee)],
+                             "call_indirect.$table\t$callee">;
 } // Uses = [SP32,SP64], isCall = 1
 
 } // Defs = [ARGUMENTS]
 
 // Patterns for matching a direct call to a global address.
 def : Pat<(i32 (WebAssemblycall1 (WebAssemblywrapper tglobaladdr:$callee))),
           (CALL_I32 tglobaladdr:$callee)>;
 def : Pat<(i64 (WebAssemblycall1 (WebAssemblywrapper tglobaladdr:$callee))),

lib/Target/WebAssembly/WebAssemblyInstrInfo.td

 def f64imm_op : Operand<f64>;
 
 let OperandType = "OPERAND_P2ALIGN" in {
 def P2Align : Operand<i32> {
   let PrintMethod = "printWebAssemblyP2AlignOperand";
 }
 } // OperandType = "OPERAND_P2ALIGN"
 
+let OperandType = "OPERAND_TABLE" in
+def table_op : Operand<i64>;
+
 } // OperandNamespace = "WebAssembly"
 
 //===----------------------------------------------------------------------===//
 // WebAssembly Instruction Format Definitions.
 //===----------------------------------------------------------------------===//
 
 include "WebAssemblyInstrFormats.td"
 

lib/Target/WebAssembly/WebAssemblyRegStackify.cpp

if (TargetRegisterInfo::isPhysicalRegister(Reg)) {
       if (!MRI.isPhysRegModified(Reg))
         continue;
       // Otherwise, it's a physical register with unknown liveness.
       return false;
     }
 
     // Ask LiveIntervals whether moving this virtual register use or def to
     // Insert will change which value numbers are seen.
-    // 
+    //
     // If the operand is a use of a register that is also defined in the same
     // instruction, test that the newly defined value reaches the insert point,
     // since the operand will be moving along with the def.
     const LiveInterval &LI = LIS.getInterval(Reg);
     VNInfo *DefVNI =
         (MO.isDef() || Def->definesRegister(Reg)) ?
         LI.getVNInfoAt(LIS.getInstructionIndex(*Def).getRegSlot()) :
         LI.getVNInfoBefore(LIS.getInstructionIndex(*Def));
for (const MachineOperand &Use : MRI.use_operands(Reg)) {
     } else {
       // Test that the use is dominated by the one selected use.
       while (!MDT.dominates(OneUseInst, UseInst)) {
         // Actually, dominating is over-conservative. Test that the use would
         // happen after the one selected use in the stack evaluation order.
         //
         // This is needed as a consequence of using implicit get_locals for
         // uses and implicit set_locals for defs.
-        if (UseInst->getDesc().getNumDefs() == 0) 
+        if (UseInst->getDesc().getNumDefs() == 0)
           return false;
         const MachineOperand &MO = UseInst->getOperand(0);
         if (!MO.isReg())
           return false;
         unsigned DefReg = MO.getReg();
         if (!TargetRegisterInfo::isVirtualRegister(DefReg) ||
             !MFI.isVRegStackified(DefReg))
           return false;

lib/Transforms/IPO/LowerTypeTests.cpp

bool LowerTypeTests::doInitialization(Module &Mod) {
 
   Int1Ty = Type::getInt1Ty(M->getContext());
   Int8Ty = Type::getInt8Ty(M->getContext());
   Int32Ty = Type::getInt32Ty(M->getContext());
   Int32PtrTy = PointerType::getUnqual(Int32Ty);
   Int64Ty = Type::getInt64Ty(M->getContext());
   IntPtrTy = DL.getIntPtrType(M->getContext(), 0);
 
-  IndirectIndex = 0;
+  // In WebAssembly, the default table is at index 0, so start creating at 1
+  IndirectIndex = 1;
 
   TypeTestCallSites.clear();
 
   return false;
 }
 
 /// Build a bit set for TypeId using the object layouts in
 /// GlobalLayout.
void LowerTypeTests::buildBitSetsFromFunctionsX86(
   std::vector<Constant *> JumpTableEntries;
   for (unsigned I = 0; I != Functions.size(); ++I)
     JumpTableEntries.push_back(
         createJumpTableEntry(JumpTable, Functions[I], I));
   JumpTable->setInitializer(
       ConstantArray::get(JumpTableType, JumpTableEntries));
 }
 
-// Assign a dummy layout based using an incrementing counter, and store this as
-// metadata. During generation of the indexed indirect function call table, the
-// backend will ensure that the appropriate indexes are used.
+// Assign each disjoint set to a different indirect function call table using
+// an incrementing counter. Then, eliminate explicit type tests. This is safe
+// because the type homogeneity of each disjoint set is checked at load-time.
+// Additionally, calls to out of bounds table entries will trap at runtime.
 void LowerTypeTests::buildBitSetsFromFunctionsWASM(
     ArrayRef<Metadata *> TypeIds, ArrayRef<Function *> Functions) {
   assert(!Functions.empty());
 
   // Build a dummy layout, and generate metadata for indirect function indexes.
   DenseMap<GlobalObject *, uint64_t> GlobalLayout;
   for (Function *F : Functions) {
     // Skip functions which are not actually used, to avoid placing extra
     // entries in the indirect function table.
     if (!F->getNumUses())
       continue;
 
     MDNode *MD = MDNode::get(F->getContext(),
                              ArrayRef<Metadata *>(ConstantAsMetadata::get(
                                  ConstantInt::get(Int64Ty, IndirectIndex))));
     F->setMetadata("wasm.index", MD);
+  }
+
+  // Tag the indirect call with the table index, and eliminate the explicit type test.
+  for (Metadata *TypeId : TypeIds) {
+    for (CallInst *TypeTest : TypeTestCallSites[TypeId]) {
+      // Find the branch statement immediately following the bitset test call.
+      BranchInst *BI = nullptr;
+      for (Use &U : TypeTest->uses()) {
+        if ((isa<BranchInst>(U.getUser()))) {
+          BI = cast<BranchInst>(U.getUser());
+          break;
+        }
+      }
+
+      // Find the original indirect call in the 'cont' block.
+      CallInst *CI = nullptr;
+      if (BI && BI->getNumSuccessors() > 0) {
+        for (Instruction &I : *BI->getSuccessor(0)) {
+          if ((isa<CallInst>(I)) && !cast<CallInst>(I).getCalledFunction()) {
+            CI = &cast<CallInst>(I);
+            break;
+          }
+        }
+      }
+
+      // Tag the indirect call with the table index
+      if (CI) {
+        MDNode *MD = MDNode::get(CI->getContext(),
+                                 ArrayRef<Metadata *>(ConstantAsMetadata::get(
+                                 ConstantInt::get(Int64Ty, IndirectIndex))));
+        CI->setMetadata("wasm.index", MD);
+      }
+
+      // Replace each type test with true, and let simplifycfg remove the branch.
+      ConstantInt *True = ConstantInt::getTrue(TypeTest->getContext());
+      TypeTest->replaceAllUsesWith(True);
+      TypeTest->eraseFromParent();
 
-    GlobalLayout[F] = IndirectIndex++;
+      ++NumTypeTestCallsLowered;
+    }
   }
 
-  // The indirect function table index space starts at zero, so pass a NULL
-  // pointer as the subtracted "jump table" offset.
-  lowerTypeTestCalls(TypeIds,
-                     ConstantPointerNull::get(cast<PointerType>(Int32PtrTy)),
-                     GlobalLayout);
+  // Increment the counter to put each disjoint set in a different table.
+  IndirectIndex += 1;
 }
 
 void LowerTypeTests::buildBitSetsFromDisjointSet(
     ArrayRef<Metadata *> TypeIds, ArrayRef<GlobalObject *> Globals) {
   llvm::DenseMap<Metadata *, uint64_t> TypeIdIndices;
   for (unsigned I = 0; I != TypeIds.size(); ++I)
     TypeIdIndices[TypeIds[I]] = I;
 

test/CodeGen/WebAssembly/call.ll

 ; CHECK-NEXT: return $pop[[NUM]]{{$}}
 define i32 @call_i32_binary(i32 %a, i32 %b) {
   %r = call i32 @i32_binary(i32 %a, i32 %b)
   ret i32 %r
 }
 
 ; CHECK-LABEL: call_indirect_void:
 ; CHECK-NEXT: .param i32{{$}}
-; CHECK-NEXT: {{^}} call_indirect $0{{$}}
+; CHECK-NEXT: {{^}} call_indirect.0 $0{{$}}
 ; CHECK-NEXT: return{{$}}
 define void @call_indirect_void(void ()* %callee) {
   call void %callee()
   ret void
 }
 
 ; CHECK-LABEL: call_indirect_i32:
 ; CHECK-NEXT: .param i32{{$}}
 ; CHECK-NEXT: .result i32{{$}}
-; CHECK-NEXT: {{^}} i32.call_indirect $push[[NUM:[0-9]+]]=, $0{{$}}
+; CHECK-NEXT: {{^}} i32.call_indirect.0 $push[[NUM:[0-9]+]]=, $0{{$}}
 ; CHECK-NEXT: return $pop[[NUM]]{{$}}
 define i32 @call_indirect_i32(i32 ()* %callee) {
   %t = call i32 %callee()
   ret i32 %t
 }
 
 ; CHECK-LABEL: tail_call_void_nullary:
 ; CHECK-NEXT: {{^}} call void_nullary@FUNCTION{{$}}

test/CodeGen/WebAssembly/cfi.ll

 ; RUN: opt -S -lowertypetests < %s | llc -asm-verbose=false -disable-wasm-fallthrough-return-opt | FileCheck %s
 
 ; Tests that we correctly assign indexes for control flow integrity.
 
 target datalayout = "e-m:e-p:32:32-i64:64-n32:64-S128"
 target triple = "wasm32-unknown-unknown"
 
 ; CHECK-LABEL: h:
 ; CHECK-NOT: .indidx
 define void @h() !type !0 {
   ret void
 }
 
 ; CHECK-LABEL: f:
-; CHECK: .indidx 0
+; CHECK: .indidx 1
 define void @f() !type !0 {
   ret void
 }
 
 ; CHECK-LABEL: g:
-; CHECK: .indidx 1
+; CHECK: .indidx 2
 define void @g() !type !1 {
   ret void
 }
 
 !0 = !{i32 0, !"typeid1"}
 !1 = !{i32 0, !"typeid2"}
 
 declare i1 @llvm.type.test(i8* %ptr, metadata %bitset) nounwind readnone
 declare void @llvm.trap() nounwind noreturn
 
 ; CHECK-LABEL: foo:
-; CHECK: br_if
-; CHECK: br_if
-; CHECK: unreachable
+; CHECK-NOT: br_if
+; CHECK-NOT: unreachable
 define i1 @foo(i8* %p) {
   call void @f()
   call void @g()
   %x = call i1 @llvm.type.test(i8* %p, metadata !"typeid1")
   br i1 %x, label %contx, label %trap
 
 trap:
   tail call void @llvm.trap() #1

test/Transforms/LowerTypeTests/function-disjoint.ll

 !1 = !{i32 0, !"typeid2"}
 
 declare i1 @llvm.type.test(i8* %ptr, metadata %bitset) nounwind readnone
 
 define i1 @foo(i8* %p) {
   call void @f()
   call void @g()
   ; X64: icmp eq i64 {{.*}}, ptrtoint ([1 x <{ i8, i32, i8, i8, i8 }>]* @[[JT0]] to i64)
-  ; WASM32: icmp eq i64 {{.*}}, 0
+  ; WASM32-NOT: icmp ult i64 {{.*}}, 0
   %x = call i1 @llvm.type.test(i8* %p, metadata !"typeid1")
   ; X64: icmp eq i64 {{.*}}, ptrtoint ([1 x <{ i8, i32, i8, i8, i8 }>]* @[[JT1]] to i64)
-  ; WASM32: icmp eq i64 {{.*}}, 1
+  ; WASM32-NOT: icmp ult i64 {{.*}}, 1
   %y = call i1 @llvm.type.test(i8* %p, metadata !"typeid2")
   %z = add i1 %x, %y
+  ; WASM32-NOT: br i1 {{.*}} label %cont, label %trap
+  ; WASM32: add i1 true, true
   ret i1 %z
 }
 
-; WASM32: ![[I0]] = !{i64 0}
-; WASM32: ![[I1]] = !{i64 1}
+; WASM32: ![[I0]] = !{i64 1}
+; WASM32: ![[I1]] = !{i64 2}

test/Transforms/LowerTypeTests/function-ext.ll

 ; RUN: opt -S -lowertypetests -mtriple=x86_64-unknown-linux-gnu < %s | FileCheck --check-prefix=X64 %s
 ; RUN: opt -S -lowertypetests -mtriple=wasm32-unknown-unknown < %s | FileCheck --check-prefix=WASM32 %s
 
 ; Tests that we correctly handle external references, including the case where
 ; all functions in a bitset are external references.
 
 ; X64: @[[JT:.*]] = private constant [1 x <{ i8, i32, i8, i8, i8 }>] [<{ i8, i32, i8, i8, i8 }> <{ i8 -23, i32 trunc (i64 sub (i64 sub (i64 ptrtoint (void ()* @foo to i64), i64 ptrtoint ([1 x <{ i8, i32, i8, i8, i8 }>]* @[[JT]] to i64)), i64 5) to i32), i8 -52, i8 -52, i8 -52 }>], section ".text"
 ; WASM32: private constant [0 x i8] zeroinitializer
 
 ; WASM32: declare !type !{{[0-9]+}} void @foo()
 declare !type !0 void @foo()
 
 define i1 @bar(i8* %ptr) {
   ; X64: icmp eq i64 {{.*}}, ptrtoint ([1 x <{ i8, i32, i8, i8, i8 }>]* @[[JT]] to i64)
-  ; WASM32: sub i64 {{.*}}, 0
-  ; WASM32: icmp ult i64 {{.*}}, 1
+  ; WASM32-NOT: sub i64 {{.*}}, 0
+  ; WASM32-NOT: icmp ult i64 {{.*}}, 1
+  ; WASM32: ret i1 true
   %p = call i1 @llvm.type.test(i8* %ptr, metadata !"void")
   ret i1 %p
 }
 
 declare i1 @llvm.type.test(i8* %ptr, metadata %bitset) nounwind readnone
 
 !0 = !{i64 0, !"void"}
 ; WASM-NOT: !{i64 0}

test/Transforms/LowerTypeTests/function.ll

 ; RUN: opt -S -lowertypetests -mtriple=x86_64-unknown-linux-gnu < %s | FileCheck --check-prefix=X64 %s
 ; RUN: opt -S -lowertypetests -mtriple=wasm32-unknown-unknown < %s | FileCheck --check-prefix=WASM32 %s
 
 ; Tests that we correctly handle bitsets containing 2 or more functions.
 
 target datalayout = "e-p:64:64"
 
 ; X64: @[[JT:.*]] = private constant [2 x <{ i8, i32, i8, i8, i8 }>] [<{ i8, i32, i8, i8, i8 }> <{ i8 -23, i32 trunc (i64 sub (i64 sub (i64 ptrtoint (void ()* @[[FNAME:.*]] to i64), i64 ptrtoint ([2 x <{ i8, i32, i8, i8, i8 }>]* @[[JT]] to i64)), i64 5) to i32), i8 -52, i8 -52, i8 -52 }>, <{ i8, i32, i8, i8, i8 }> <{ i8 -23, i32 trunc (i64 sub (i64 sub (i64 ptrtoint (void ()* @[[GNAME:.*]] to i64), i64 ptrtoint ([2 x <{ i8, i32, i8, i8, i8 }>]* @[[JT]] to i64)), i64 13) to i32), i8 -52, i8 -52, i8 -52 }>], section ".text"
 ; WASM32: private constant [0 x i8] zeroinitializer
 
 ; X64: @f = alias void (), bitcast ([2 x <{ i8, i32, i8, i8, i8 }>]* @[[JT]] to void ()*)
 ; X64: @g = alias void (), bitcast (<{ i8, i32, i8, i8, i8 }>* getelementptr inbounds ([2 x <{ i8, i32, i8, i8, i8 }>], [2 x <{ i8, i32, i8, i8, i8 }>]* @[[JT]], i64 0, i64 1) to void ()*)
 
 ; X64: define private void @[[FNAME]]()
-; WASM32: define void @f() !type !{{[0-9]+}} !wasm.index ![[I0:[0-9]+]]
+; WASM32: define void @f() !type !{{[0-9]+}} !wasm.index ![[I:[0-9]+]]
 define void @f() !type !0 {
   ret void
 }
 
 ; X64: define private void @[[GNAME]]()
-; WASM32: define void @g() !type !{{[0-9]+}} !wasm.index ![[I1:[0-9]+]]
+; WASM32: define void @g() !type !{{[0-9]+}} !wasm.index ![[I]]
 define void @g() !type !0 {
   ret void
 }
 
 !0 = !{i32 0, !"typeid1"}
 
 declare i1 @llvm.type.test(i8* %ptr, metadata %bitset) nounwind readnone
 
 define i1 @foo(i8* %p) {
   call void @f()
   call void @g()
   ; X64: sub i64 {{.*}}, ptrtoint ([2 x <{ i8, i32, i8, i8, i8 }>]* @[[JT]] to i64)
-  ; WASM32: sub i64 {{.*}}, 0
-  ; WASM32: icmp ult i64 {{.*}}, 2
+  ; WASM32-NOT: sub i64 {{.*}}, 0
+  ; WASM32-NOT: icmp ult i64 {{.*}}, 2
+  ; WASM32-NOT: br i1 {{.*}} label %cont, label %trap
+  ; WASM32: ret i1 true
   %x = call i1 @llvm.type.test(i8* %p, metadata !"typeid1")
   ret i1 %x
 }
 
-; WASM32: ![[I0]] = !{i64 0}
-; WASM32: ![[I1]] = !{i64 1}
+; WASM32: ![[I]] = !{i64 1}