Skip to content

Commit 3304a18

Browse files
takikawatakikawa
committed
[Wasm-GC] Add missing type expansion for arrays, structs
https://bugs.webkit.org/show_bug.cgi?id=250489 Reviewed by Justin Michaud. Adds `expand()` calls where necessary to ensure that recursive/subtype types work with array and struct operations. Also add tests to exercise these cases. * JSTests/wasm/gc/arrays.js: (testArrayNewDefault): (testArrayGet): * JSTests/wasm/gc/structs.js: (testStructNewDefault): * Source/JavaScriptCore/wasm/WasmAirIRGeneratorBase.h: (JSC::Wasm::ExpressionType>::addArrayNew): (JSC::Wasm::ExpressionType>::addArrayNewDefault): (JSC::Wasm::ExpressionType>::addArrayGet): (JSC::Wasm::ExpressionType>::addStructNew): (JSC::Wasm::ExpressionType>::addStructNewDefault): * Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::B3IRGenerator::addArrayNew): (JSC::Wasm::B3IRGenerator::addArrayNewDefault): (JSC::Wasm::B3IRGenerator::addArrayGet): (JSC::Wasm::B3IRGenerator::addArraySet): (JSC::Wasm::B3IRGenerator::addStructNew): (JSC::Wasm::B3IRGenerator::addStructNewDefault): * Source/JavaScriptCore/wasm/WasmFunctionParser.h: (JSC::Wasm::FunctionParser<Context>::parseStructTypeIndex): (JSC::Wasm::FunctionParser<Context>::parseStructTypeIndexAndFieldIndex): (JSC::Wasm::FunctionParser<Context>::parseStructFieldManipulation): (JSC::Wasm::FunctionParser<Context>::parseExpression): * Source/JavaScriptCore/wasm/WasmOperationsInlines.h: (JSC::Wasm::arrayNew): (JSC::Wasm::arrayGet): (JSC::Wasm::arraySet): (JSC::Wasm::structNew): * Source/JavaScriptCore/wasm/WasmSlowPaths.cpp: (JSC::LLInt::WASM_SLOW_PATH_DECL): * Source/JavaScriptCore/wasm/js/JSWebAssemblyStruct.cpp: (JSC::JSWebAssemblyStruct::JSWebAssemblyStruct): (JSC::JSWebAssemblyStruct::tryCreate): * Source/JavaScriptCore/wasm/js/JSWebAssemblyStruct.h: Canonical link: https://commits.webkit.org/259042@main
1 parent 69bce7a commit 3304a18

File tree

9 files changed

+183
-36
lines changed

9 files changed

+183
-36
lines changed

‎JSTests/wasm/gc/arrays.js‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,16 @@ function testArrayNew() {
171171
(array.new_canon 0 (i32.const 42) (i32.const 5)))
172172
)
173173
`);
174+
175+
instantiate(`
176+
(module
177+
;; Test with subtype as well.
178+
(type (array i32))
179+
(type (sub 0 (array i32)))
180+
(func (result (ref 0))
181+
(array.new_canon 1 (i32.const 42) (i32.const 5)))
182+
)
183+
`);
174184
}
175185

176186
function testArrayNewDefault() {
@@ -181,6 +191,16 @@ function testArrayNewDefault() {
181191
(array.new_canon_default 0 (i32.const 5)))
182192
)
183193
`);
194+
195+
instantiate(`
196+
(module
197+
;; Test with subtype as well.
198+
(type (array i32))
199+
(type (sub 0 (array i32)))
200+
(func (result (ref 0))
201+
(array.new_canon_default 1 (i32.const 5)))
202+
)
203+
`);
184204
}
185205

186206
function testArrayGet() {
@@ -197,6 +217,21 @@ function testArrayGet() {
197217
assert.eq(m.exports.f(), 0);
198218
}
199219

220+
{
221+
let m = instantiate(`
222+
(module
223+
;; Test with a subtype as well.
224+
(type (array i32))
225+
(type (sub 0 (array i32)))
226+
(func (export "f") (result i32)
227+
(array.new_canon 1 (i32.const 0) (i32.const 5))
228+
(i32.const 3)
229+
(array.get 1))
230+
)
231+
`);
232+
assert.eq(m.exports.f(), 0);
233+
}
234+
200235
{
201236
let m = instantiate(`
202237
(module
@@ -370,6 +405,25 @@ function testArraySet() {
370405
assert.eq(m.exports.get(3), 84);
371406
}
372407

408+
{
409+
let m = instantiate(`
410+
(module
411+
;; Test with a subtype as well.
412+
(type (array (mut i32)))
413+
(type (sub 0 (array (mut i32))))
414+
(global (mut (ref null 0)) (ref.null 0))
415+
(func (export "init")
416+
(global.set 0 (array.new_canon 1 (i32.const 42) (i32.const 5)))
417+
(array.set 1 (global.get 0) (i32.const 3) (i32.const 84)))
418+
(func (export "get") (param i32) (result i32)
419+
(array.get 1 (global.get 0) (local.get 0)))
420+
)
421+
`);
422+
m.exports.init();
423+
assert.eq(m.exports.get(0), 42);
424+
assert.eq(m.exports.get(3), 84);
425+
}
426+
373427
{
374428
let m = instantiate(`
375429
(module

‎JSTests/wasm/gc/structs.js‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -228,6 +228,19 @@ function testStructNew() {
228228
)
229229
`).exports.main();
230230

231+
instantiate(`
232+
(module
233+
;; Also test with subtype.
234+
(type (struct))
235+
(type $Empty (sub 0 (struct)))
236+
(func (export "main")
237+
(drop
238+
(struct.new_canon $Empty)
239+
)
240+
)
241+
)
242+
`).exports.main();
243+
231244
{
232245
/*
233246
* (module
@@ -318,6 +331,19 @@ function testStructNewDefault() {
318331
)
319332
`).exports.main();
320333

334+
instantiate(`
335+
(module
336+
;; Also test with subtype.
337+
(type (struct))
338+
(type $Empty (sub 0 (struct)))
339+
(func (export "main")
340+
(drop
341+
(struct.new_canon_default $Empty)
342+
)
343+
)
344+
)
345+
`).exports.main();
346+
321347
instantiate(`
322348
(module
323349
(type $Point (struct (field $x i32) (field $y i32)))
@@ -420,6 +446,22 @@ function testStructGet() {
420446
assert.eq(main(), 0);
421447
}
422448

449+
{
450+
let main = instantiate(`
451+
(module
452+
;; Test subtype case as well.
453+
(type (struct (field i32)))
454+
(type $Point (sub 0 (struct (field $x i32))))
455+
(func (export "main") (result i32)
456+
(struct.get $Point $x
457+
(struct.new_canon $Point (i32.const 37))
458+
)
459+
)
460+
)
461+
`).exports.main;
462+
assert.eq(main(), 37);
463+
}
464+
423465
{
424466
/*
425467
* Point(f32)
@@ -778,6 +820,57 @@ function testStructSet() {
778820
assert.eq(main(), 37);
779821
}
780822

823+
{
824+
let main = instantiate(`
825+
(module
826+
;; Test subtype case as well.
827+
(type (struct (field (mut i32))))
828+
(type $Point (sub 0 (struct (field $x (mut i32)))))
829+
(func $doTest (param $p (ref $Point)) (result i32)
830+
(struct.set $Point $x
831+
(local.get $p)
832+
(i32.const 37)
833+
)
834+
(struct.get $Point $x
835+
(local.get $p)
836+
)
837+
)
838+
839+
(func (export "main") (result i32)
840+
(call $doTest
841+
(struct.new_canon $Point (i32.const 0))
842+
)
843+
)
844+
)
845+
`).exports.main;
846+
assert.eq(main(), 37);
847+
}
848+
849+
// Test actually passing a point that is a subtype to a $Point interface.
850+
{
851+
let main = instantiate(`
852+
(module
853+
(type $Point (struct (field $x (mut i32))))
854+
(type $Sub (sub 0 (struct (field (mut i32) (mut i32)))))
855+
(func $doTest (result i32) (local $p (ref null $Sub))
856+
(local.set $p (struct.new_canon $Sub (i32.const 0) (i32.const 1)))
857+
(struct.set $Point $x
858+
(local.get $p)
859+
(i32.const 37)
860+
)
861+
(struct.get $Point $x
862+
(local.get $p)
863+
)
864+
)
865+
866+
(func (export "main") (result i32)
867+
(call $doTest)
868+
)
869+
)
870+
`).exports.main;
871+
assert.eq(main(), 37);
872+
}
873+
781874
{
782875
/*
783876
* Point(f32)

‎Source/JavaScriptCore/wasm/WasmAirIRGeneratorBase.h‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2476,7 +2476,7 @@ auto AirIRGeneratorBase<Derived, ExpressionType>::addCheckedFloatingPointTruncat
24762476
template<typename Derived, typename ExpressionType>
24772477
auto AirIRGeneratorBase<Derived, ExpressionType>::addArrayNew(uint32_t typeIndex, ExpressionType size, ExpressionType value, ExpressionType& result) -> PartialResult
24782478
{
2479-
Wasm::TypeDefinition& arraySignature = m_info.typeSignatures[typeIndex];
2479+
const Wasm::TypeDefinition& arraySignature = m_info.typeSignatures[typeIndex]->expand();
24802480
ASSERT(arraySignature.is<ArrayType>());
24812481

24822482
ExpressionType tmpForValue;
@@ -2492,7 +2492,7 @@ auto AirIRGeneratorBase<Derived, ExpressionType>::addArrayNew(uint32_t typeIndex
24922492
template <typename Derived, typename ExpressionType>
24932493
auto AirIRGeneratorBase<Derived, ExpressionType>::addArrayNewDefault(uint32_t typeIndex, ExpressionType size, ExpressionType& result) -> PartialResult
24942494
{
2495-
Wasm::TypeDefinition& arraySignature = m_info.typeSignatures[typeIndex];
2495+
const Wasm::TypeDefinition& arraySignature = m_info.typeSignatures[typeIndex]->expand();
24962496
ASSERT(arraySignature.is<ArrayType>());
24972497
const StorageType& elementType = arraySignature.as<ArrayType>()->elementType().type;
24982498

@@ -2517,7 +2517,7 @@ auto AirIRGeneratorBase<Derived, ExpressionType>::addArrayGet(ExtGCOpType arrayG
25172517
{
25182518
ASSERT(arrayGetKind == ExtGCOpType::ArrayGet || arrayGetKind == ExtGCOpType::ArrayGetS || arrayGetKind == ExtGCOpType::ArrayGetU);
25192519

2520-
Wasm::TypeDefinition& arraySignature = m_info.typeSignatures[typeIndex];
2520+
const Wasm::TypeDefinition& arraySignature = m_info.typeSignatures[typeIndex]->expand();
25212521
ASSERT(arraySignature.is<ArrayType>());
25222522
Wasm::StorageType elementType = arraySignature.as<ArrayType>()->elementType().type;
25232523
Wasm::Type resultType = elementType.unpacked();
@@ -2606,7 +2606,7 @@ auto AirIRGeneratorBase<Derived, ExpressionType>::addStructNew(uint32_t typeInde
26062606
// https://bugs.webkit.org/show_bug.cgi?id=244388
26072607
self().emitCCall(&operationWasmStructNewEmpty, result, instanceValue(), self().addConstant(Types::I32, typeIndex));
26082608

2609-
const auto& structType = *m_info.typeSignatures[typeIndex]->template as<StructType>();
2609+
const auto& structType = *m_info.typeSignatures[typeIndex]->expand().template as<StructType>();
26102610
for (unsigned i = 0; i < args.size(); ++i) {
26112611
auto status = self().addStructSet(result, structType, i, args[i]);
26122612
if (!status)
@@ -2624,7 +2624,7 @@ auto AirIRGeneratorBase<Derived, ExpressionType>::addStructNewDefault(uint32_t t
26242624
// https://bugs.webkit.org/show_bug.cgi?id=244388
26252625
self().emitCCall(&operationWasmStructNewEmpty, result, instanceValue(), self().addConstant(Types::I32, typeIndex));
26262626

2627-
const auto& structType = *m_info.typeSignatures[typeIndex]->template as<StructType>();
2627+
const auto& structType = *m_info.typeSignatures[typeIndex]->expand().template as<StructType>();
26282628
for (StructFieldCount i = 0; i < structType.fieldCount(); ++i) {
26292629
ExpressionType tmpForValue;
26302630
if (Wasm::isRefType(structType.field(i).type))

‎Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2608,7 +2608,7 @@ Variable* B3IRGenerator::pushArrayNew(uint32_t typeIndex, Value* initValue, Expr
26082608
auto B3IRGenerator::addArrayNew(uint32_t typeIndex, ExpressionType size, ExpressionType value, ExpressionType& result) -> PartialResult
26092609
{
26102610
#if ASSERT_ENABLED
2611-
Wasm::TypeDefinition& arraySignature = m_info.typeSignatures[typeIndex];
2611+
const Wasm::TypeDefinition& arraySignature = m_info.typeSignatures[typeIndex]->expand();
26122612
ASSERT(arraySignature.is<ArrayType>());
26132613
const StorageType& elementType = arraySignature.as<ArrayType>()->elementType().type;
26142614
ASSERT(toB3Type(elementType.unpacked()) == value->type());
@@ -2631,7 +2631,7 @@ auto B3IRGenerator::addArrayNew(uint32_t typeIndex, ExpressionType size, Express
26312631

26322632
auto B3IRGenerator::addArrayNewDefault(uint32_t typeIndex, ExpressionType size, ExpressionType& result) -> PartialResult
26332633
{
2634-
Wasm::TypeDefinition& arraySignature = m_info.typeSignatures[typeIndex];
2634+
const Wasm::TypeDefinition& arraySignature = m_info.typeSignatures[typeIndex]->expand();
26352635
ASSERT(arraySignature.is<ArrayType>());
26362636

26372637
Value* initValue;
@@ -2647,7 +2647,7 @@ auto B3IRGenerator::addArrayNewDefault(uint32_t typeIndex, ExpressionType size,
26472647

26482648
auto B3IRGenerator::addArrayGet(ExtGCOpType arrayGetKind, uint32_t typeIndex, ExpressionType arrayref, ExpressionType index, ExpressionType& result) -> PartialResult
26492649
{
2650-
Wasm::TypeDefinition& arraySignature = m_info.typeSignatures[typeIndex];
2650+
const Wasm::TypeDefinition& arraySignature = m_info.typeSignatures[typeIndex]->expand();
26512651
ASSERT(arraySignature.is<ArrayType>());
26522652
Wasm::StorageType elementType = arraySignature.as<ArrayType>()->elementType().type;
26532653
Wasm::Type resultType = elementType.unpacked();
@@ -2728,7 +2728,7 @@ auto B3IRGenerator::addArrayGet(ExtGCOpType arrayGetKind, uint32_t typeIndex, Ex
27282728
auto B3IRGenerator::addArraySet(uint32_t typeIndex, ExpressionType arrayref, ExpressionType index, ExpressionType value) -> PartialResult
27292729
{
27302730
#if ASSERT_ENABLED
2731-
Wasm::TypeDefinition& arraySignature = m_info.typeSignatures[typeIndex];
2731+
const Wasm::TypeDefinition& arraySignature = m_info.typeSignatures[typeIndex]->expand();
27322732
ASSERT(arraySignature.is<ArrayType>());
27332733
#endif
27342734

@@ -2797,7 +2797,7 @@ auto B3IRGenerator::addStructNew(uint32_t typeIndex, Vector<ExpressionType>& arg
27972797
instanceValue(),
27982798
m_currentBlock->appendNew<Const32Value>(m_proc, origin(), typeIndex));
27992799

2800-
const auto& structType = *m_info.typeSignatures[typeIndex]->template as<StructType>();
2800+
const auto& structType = *m_info.typeSignatures[typeIndex]->expand().template as<StructType>();
28012801
for (uint32_t i = 0; i < args.size(); ++i)
28022802
emitStructSet(structValue, i, structType, get(args[i]));
28032803

@@ -2816,7 +2816,7 @@ auto B3IRGenerator::addStructNewDefault(uint32_t typeIndex, ExpressionType& resu
28162816
instanceValue(),
28172817
m_currentBlock->appendNew<Const32Value>(m_proc, origin(), typeIndex));
28182818

2819-
const auto& structType = *m_info.typeSignatures[typeIndex]->template as<StructType>();
2819+
const auto& structType = *m_info.typeSignatures[typeIndex]->expand().template as<StructType>();
28202820
for (StructFieldCount i = 0; i < structType.fieldCount(); ++i) {
28212821
Value* initValue;
28222822
if (Wasm::isRefType(structType.field(i).type))

0 commit comments

Comments
 (0)