summaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* Generalize moving of identical code from if/select arms (#3833)Alon Zakai2021-04-212-19/+44
| | | | | | | | | | | | | | | Effects are fine in the moved code, if we are doing so on an if (which runs just one arm anyhow). Allow unreachable, which lets us hoist returns for example. Allow none, which lets us hoist drop and call for example. For this we also need to be careful with subtyping, as at least drop is polymorphic, so the child types may not have an LUB (see example in code). Adds a small ShallowEffectAnalyzer child of EffectAnalyzer that calls visit to just do a shallow analysis (instead of walk which walks the children).
* wasm-metadce: Keep symbols alive if there is any refeence to corresponding ↵Sam Clegg2021-04-211-0/+11
| | | | | | | | GOT.mem or GOT.func import (#3831) This prevents the DCE of used symbols in emscripten's `MAIN_MODULE=2` use case which we are starting to use and recommend a lot more. Part of the fix for https://github.com/emscripten-core/emscripten/issues/13786
* OptimizeInstructions: Move identical unary code out of if/select arms (#3828)Alon Zakai2021-04-211-9/+74
| | | | | | | | | | | | | | | | | | | | | (select (foo (X) ) (foo (Y) ) (condition) ) => (foo (select (X) (Y) (condition) ) ) To make this simpler, refactor optimizeTernary to be templated.
* [Wasm GC] Fix handleNonDefaultableLocals on tees (#3830)Alon Zakai2021-04-211-1/+22
| | | | | | | When we change a local's type, as we do in that method when we turn a non-nullable (invalid) local into a nullable (valid) one, we must update tees as well as gets - their type must match the changed local type, and we must cast them so that their users do not see a change.
* Refactor Child*Iterator for simplicity and to allow modifications. NFC (#3826)Alon Zakai2021-04-201-36/+66
| | | | | | | | | | | | | | | | | | | Instead of creating a class and doing a traversal, simply use wasm-delegates-fields to get the children directly. This is simpler and faster. This requires a new way to override the behavior by ChildValueIterator. I ended up using CRTP. This stores pointers to the children instead of the children. This will allow modifying the children using these classes (which is the reason I started this refactoring - next PR will use it). This is also slightly faster in theory as we avoid doing loads from memory to find the children (which maybe we never get to doing if the iteration is stopped early). Not the goal here, but this speeds up roundtripping by 12%. This is NFC as nothing uses the new ability to modify things yet.
* Fix element segment ordering in Print (#3818)Abbas Mashayekh2021-04-201-16/+3
| | | | | | | | | | | We used to print active element segments right after corresponding tables, and passive segments came after those. We didn't print internal segment names, and empty segments weren't being printed at all. This meant that there was no way for instructions to refer to those table segments after round tripping. This will fix those issues by printing segments in the order they were defined, including segment names when necessary and not omitting empty segments anymore.
* Run spec test all at once after binary transform (#3817)Abbas Mashayekh2021-04-202-27/+25
| | | | | | | | | | | | | | | | | | #3792 added support for module linking and (register command to wasm-shell, but forgot about three problems: - Splitting spec tests prevents linking test modules together. - Registered modules may still be used in assertions or an invoke - Modules may re-export imported objects This PR appends transformed modules after binary checks to a spec.wast file, plus assertion tests and register commands. Then runs wasm-shell on the whole file. It also keeps both the module name and its registered name available in wasm-shell for use in shell commands and linked modules. Furthermore, it correctly finds the module where an object is defined even if it is imported and re-exported several times. The updated version of imports.wast spec test is enabled to verify the fixes.
* Minor wasm-split improvements (#3825)Thomas Lively2021-04-203-43/+49
| | | | | | | | | | | - Support functions appearing more than once in the table. It turns out we were assuming and asserting that functions would appear at most once, but we weren't making use of that assumption in any way. - Make TableSlotManager::getSlot take a function Name rather than a RefFunc expression to avoid allocating and leaking unnecessary expressions. - Add and use a Builder interface for building TableElementSegments to make them more similar to other module-level items.
* Implement missing if restructuring (#3819)Alon Zakai2021-04-201-12/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The existing restructuring code could turn a block+br_if into an if in simple cases, but it had some TODOs that I noticed were helpful on GC benchmarks. One limitation was that we need to reorder the condition and the value, (block (br_if (value) (condition) ) (...) ) => (if (condition) (value) (...) ) The old code checked for side effects in the condition. But it is ok for it to have side effects if they can be reordered with the value (for example, if the value is a constant then it definitely does not care about side effects in the condition). The other missing TODO is to use a select when we can't use an if: (block (drop (br_if (value) (condition) ) ) (...) ) => (select (value) (...) (condition) ) In this case we do not reorder the condition and the value, but we do reorder the condition with the rest of the block.
* [Wasm GC] Fix the type of ref.as_func, which should be non-nullable (#3821)Alon Zakai2021-04-201-1/+1
|
* Optimize if/select with one arm an EqZ and another a 0 or a 1 (#3822)Alon Zakai2021-04-201-0/+61
| | | | | | | | | | | | | | | | | | | | | | (select (i32.eqz (X)) (i32.const 0|1) (Y) ) => (i32.eqz (select (X) (i32.const 1|0) (Y) ) ) This is beneficial as the eqz may be folded into something on the outside. I see this pattern in real-world code, both a GC benchmark (which is why I noticed it) and it shrinks code size by tiny amounts on the emscripten benchmark suite as well.
* [Wasm GC] Reorder ref.as_non_null with tee and cast (#3820)Alon Zakai2021-04-191-0/+51
| | | | In both cases doing the ref.as_non_null last is beneficial as we have optimizations that can remove it based on where it is consumed.
* [Wasm GC] Optimize reference identity checks (#3814)Alon Zakai2021-04-193-0/+53
| | | | | * Note that ref.cast has a fallthrough value. * Optimize ref.eq on identical inputs.
* LegalizeJSInterface: Remove illegal imports once they are no longer used (#3815)Sam Clegg2021-04-161-0/+5
| | | | | | | | | This prevents used imports which also happen to have duplicate names and therefore cannot be provided by wasm (JS is happen to fill these in with polymorphic JS functions). I noticed this when working on emscripten and directly hooking modules together. I was seeing failures, but not in release builds (because wasm-opt would mop these up in release builds).
* Very simple module linking in wasm-shell (#3792)Abbas Mashayekh2021-04-166-415/+624
| | | | | | | | | | | | | | | | | | | | This is a rewrite of the wasm-shell tool, with the goal of improved compatibility with the reference interpreter and the spec test suite. To facilitate that, module instances are provided with a list of linked instances, and imported objects are looked up in the correct instance. The new shell can: - register and link modules using the (register ...) command. - parse binary modules with the syntax (module binary ...). - provide the "spectest" module defined in the reference interpreter - assert instantiation traps with assert_trap - better check linkability by looking up the linked instances in - assert_unlinkable It cannot call external function references that are not direct imports. That would require bigger changes.
* [Wasm GC] Fix precompute on GC data (#3810)Alon Zakai2021-04-152-13/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes precomputation on GC after #3803 was too optimistic. The issue is subtle. Precompute will repeatedly evaluate expressions and propagate their values, flowing them around, and it ignores side effects when doing so. For example: (block ..side effect.. (i32.const 1) ) When we evaluate that we see there are side effects, but regardless of them we know the value flowing out is 1. So we can propagate that value, if it is assigned to a local and read elsewhere. This is not valid for GC because struct.new and array.new have a "side effect" that is noticeable in the result. Each time we call struct.new we get a new struct with a new address, which ref.eq can distinguish. So when this pass evaluates the same thing multiple times it will get a different result. Also, we can't precompute a struct.get even if we know the struct, not unless we know the reference has not escaped (where a call could modify it). To avoid all that, do not precompute references, aside from the trivially safe ones like nulls and function references (simple constants that are the same each time we evaluate the expression emitting them). precomputeExpression() had a minor bug which this fixes. It checked the type of the expression to see if we can create a constant for it, but really it should check the value - since (separate from this PR) we have no way to emit a "constant" for a struct etc. Also that only matters if replaceExpression is true, that is, if we are replacing with a constant; if we just want the value internally, we have no limit on that. Also add Literal support for comparing GC refs, which is used by ref.eq. Without that tiny fix the tests here crash. This adds a bunch of tests, many for corner cases that we don't handle (since the PR makes us not propagate GC references). But they should be helpful if/when we do, to avoid the mistakes in #3803
* Rename emscripten metadata key to reflect new unmangled names (#3813)Sam Clegg2021-04-151-1/+1
| | | | | | Turns out just removing the mangling wasn't enough for emscripten to support both before and after versions. See https://github.com/WebAssembly/binaryen/pull/3785
* Remove renaming of __wasm_call_ctors (#3811)Sam Clegg2021-04-153-11/+0
| | | See https://github.com/emscripten-core/emscripten/issues/13893
* Remove final remnants of name mangling from wasm-emscripten (#3785)Sam Clegg2021-04-151-1/+1
| | | See https://github.com/emscripten-core/emscripten/pull/13847
* Fix lock-free MixedArena allocation (#3807)Thomas Lively2021-04-141-1/+1
| | | | | | | | | | | | | | | | | To reduce allocator contention, MixedArena transparently forwards allocations to a thread-local arena by traversing a linked list of arenas, looking for the one corresponding to the current thread. If the search reaches the end of the linked list, it allocates a new arena for the current thread and atomically appends it to the end of the list using a compare-and-swap operation. The problem was that the previous code used `compare_exchange_weak`, which is allowed to spuriously fail, i.e. it is allowed to behave as though the original value is not the same as the expected value, even when it is. In this case, that means that it might fail to append the new allocation to the list even if the `next` pointer is still null, which results in a subsequent null pointer dereference. The fix is to use `compare_exchange_strong`, which is not allowed to spuriously fail in this way. Reported in #3806.
* [Wasm GC] Do not inline a function with an RTT parameter (#3808)Alon Zakai2021-04-147-8/+34
| | | | | Inlined parameters become locals, and rtts cannot be handled as locals, unlike non-nullable values which we can at least fix up. So do not inline functions with rtt params.
* [Wasm GC] Full precompute support for GC (#3803)Alon Zakai2021-04-132-6/+12
| | | | | | | | | | | | The precompute pass ignored all reference types, but that was overly pessimistic: we can precompute some of them, namely a null and a reference to a function are fully precomputable, etc. To allow that to work, add missing integration in getFallthrough as well. With this, we can precompute quite a lot of field accesses in the existing -Oz testcase, as can be seen from the output. That testcase runs --fuzz-exec so it prints out all those logged values, proving they have not changed.
* Fuzzer: Distinguish traps from host limitations (#3801)Alon Zakai2021-04-124-2/+40
| | | | | | | | | Host limitations are arbitrary and can be modified by optimizations, so ignore them. For example, if the optimizer removes allocations then a host limit on an allocation error may vanish. Or, an optimization that removes recursion and replaces it with a loop may avoid a host limit on call depth (that is not done currently, but might some day). This removes a class of annoying false positives in the fuzzer.
* Reducer: Replace entire function bodies with either unreachable or nop (#3802)Alon Zakai2021-04-121-5/+15
| | | | | Previously we just used unreachable. This also tries nop when it is possible, and sometimes that is better (if the code is called, a nop may be less intrusive of a change).
* [Wasm GC] Optimize away unnecessary non-null assertions (#3800)Alon Zakai2021-04-121-0/+27
| | | | | | ref.as_non_null is not needed if the value flows into a place that traps on null anyhow. We replace a trap on one instruction with a trap on another, but we allow such things (and even changing trap types, which does not happen here).
* Rename SIMD extending load instructions (#3798)Daniel Wirtz2021-04-1213-114/+102
| | | | | | | | | Renames the SIMD instructions * LoadExtSVec8x8ToVecI16x8 -> Load8x8SVec128 * LoadExtUVec8x8ToVecI16x8 -> Load8x8UVec128 * LoadExtSVec16x4ToVecI32x4 -> Load16x4SVec128 * LoadExtUVec16x4ToVecI32x4 -> Load16x4UVec128 * LoadExtSVec32x2ToVecI64x2 -> Load32x2SVec128 * LoadExtUVec32x2ToVecI64x2 -> Load32x2UVec128
* Update SIMD binary constants (#3799)Daniel Wirtz2021-04-123-181/+181
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Updates binary constants of SIMD instructions to match new opcodes: * I16x8LoadExtSVec8x8 -> V128Load8x8S * I16x8LoadExtUVec8x8 -> V128Load8x8U * I32x4LoadExtSVec16x4 -> V128Load16x4S * I32x4LoadExtUVec16x4 -> V128Load16x4U * I64x2LoadExtSVec32x2 -> V128Load32x2S * I64x2LoadExtUVec32x2 -> V128Load32x2U * V8x16LoadSplat -> V128Load8Splat * V16x8LoadSplat -> V128Load16Splat * V32x4LoadSplat -> V128Load32Splat * V64x2LoadSplat -> V128Load64Splat * V8x16Shuffle -> I8x16Shuffle * V8x16Swizzle -> I8x16Swizzle * V128AndNot -> V128Andnot * F32x4DemoteZeroF64x2 -> F32x4DemoteF64x2Zero * I8x16NarrowSI16x8 -> I8x16NarrowI16x8S * I8x16NarrowUI16x8 -> I8x16NarrowI16x8U * I16x8ExtAddPairWiseSI8x16 -> I16x8ExtaddPairwiseI8x16S * I16x8ExtAddPairWiseUI8x16 -> I16x8ExtaddPairwiseI8x16U * I32x4ExtAddPairWiseSI16x8 -> I32x4ExtaddPairwiseI16x8S * I32x4ExtAddPairWiseUI16x8 -> I32x4ExtaddPairwiseI16x8U * I16x8Q15MulrSatS -> I16x8Q15mulrSatS * I16x8NarrowSI32x4 -> I16x8NarrowI32x4S * I16x8NarrowUI32x4 -> I16x8NarrowI32x4U * I16x8ExtendLowSI8x16 -> I16x8ExtendLowI8x16S * I16x8ExtendHighSI8x16 -> I16x8ExtendHighI8x16S * I16x8ExtendLowUI8x16 -> I16x8ExtendLowI8x16U * I16x8ExtendHighUI8x16 -> I16x8ExtendHighI8x16U * I16x8ExtMulLowSI8x16 -> I16x8ExtmulLowI8x16S * I16x8ExtMulHighSI8x16 -> I16x8ExtmulHighI8x16S * I16x8ExtMulLowUI8x16 -> I16x8ExtmulLowI8x16U * I16x8ExtMulHighUI8x16 -> I16x8ExtmulHighI8x16U * I32x4ExtendLowSI16x8 -> I32x4ExtendLowI16x8S * I32x4ExtendHighSI16x8 -> I32x4ExtendHighI16x8S * I32x4ExtendLowUI16x8 -> I32x4ExtendLowI16x8U * I32x4ExtendHighUI16x8 -> I32x4ExtendHighI16x8U * I32x4DotSVecI16x8 -> I32x4DotI16x8S * I32x4ExtMulLowSI16x8 -> I32x4ExtmulLowI16x8S * I32x4ExtMulHighSI16x8 -> I32x4ExtmulHighI16x8S * I32x4ExtMulLowUI16x8 -> I32x4ExtmulLowI16x8U * I32x4ExtMulHighUI16x8 -> I32x4ExtmulHighI16x8U * I64x2ExtendLowSI32x4 -> I64x2ExtendLowI32x4S * I64x2ExtendHighSI32x4 -> I64x2ExtendHighI32x4S * I64x2ExtendLowUI32x4 -> I64x2ExtendLowI32x4U * I64x2ExtendHighUI32x4 -> I64x2ExtendHighI32x4U * I64x2ExtMulLowSI32x4 -> I64x2ExtmulLowI32x4S * I64x2ExtMulHighSI32x4 -> I64x2ExtmulHighI32x4S * I64x2ExtMulLowUI32x4 -> I64x2ExtmulLowI32x4U * I64x2ExtMulHighUI32x4 -> I64x2ExtmulHighI32x4U * F32x4PMin -> F32x4Pmin * F32x4PMax -> F32x4Pmax * F64x2PMin -> F64x2Pmin * F64x2PMax -> F64x2Pmax * I32x4TruncSatSF32x4 -> I32x4TruncSatF32x4S * I32x4TruncSatUF32x4 -> I32x4TruncSatF32x4U * F32x4ConvertSI32x4 -> F32x4ConvertI32x4S * F32x4ConvertUI32x4 -> F32x4ConvertI32x4U * I32x4TruncSatZeroSF64x2 -> I32x4TruncSatF64x2SZero * I32x4TruncSatZeroUF64x2 -> I32x4TruncSatF64x2UZero * F64x2ConvertLowSI32x4 -> F64x2ConvertLowI32x4S * F64x2ConvertLowUI32x4 -> F64x2ConvertLowI32x4U
* Rename various SIMD load instructions (#3795)Daniel Wirtz2021-04-1113-94/+94
| | | | | | | | | Renames the SIMD instructions * LoadSplatVec8x16 -> Load8SplatVec128 * LoadSplatVec16x8 -> Load16SplatVec128 * LoadSplatVec32x4 -> Load32SplatVec128 * LoadSplatVec64x2 -> Load64SplatVec128 * Load32Zero -> Load32ZeroVec128 * Load64Zero -> Load64ZeroVec128
* wasm-split: Update dylink section when growing table (#3791)Sam Clegg2021-04-093-2/+5
|
* wasm-emscripten: Remove unused EM_ASM_PREFIX and STACK_INIT (#3786)Sam Clegg2021-04-081-6/+1
| | | | I'm not sure what `stack$init` is but I don't think its been used for many years.
* RefFunc: Validate that the type is non-nullable, and avoid possible bugs in ↵Alon Zakai2021-04-088-26/+20
| | | | | | | | the builder (#3790) The builder can receive a HeapType so that callers don't need to set non-nullability themselves. Not NFC as some of the callers were in fact still making it nullable.
* Fuzzer: Do not assume table 0 is funcref, as initial content may include a ↵Alon Zakai2021-04-081-1/+4
| | | | non-funcref table (#3787)
* Add v128.load/storeN_lane SIMD instructions to C/JS API (#3784)Daniel Wirtz2021-04-0812-80/+152
| | | | | | | | | | | Adds C/JS APIs for the SIMD instructions * Load8LaneVec128 (was LoadLaneVec8x16) * Load16LaneVec128 (was LoadLaneVec16x8) * Load32LaneVec128 (was LoadLaneVec32x4) * Load64LaneVec128 (was LoadLaneVec64x2) * Store8LaneVec128 (was StoreLaneVec8x16) * Store16LaneVec128 (was StoreLaneVec16x8) * Store32LaneVec128 (was StoreLaneVec32x4) * Store64LaneVec128 (was StoreLaneVec64x2)
* Add v128.load32/64_zero SIMD instructions to C/JS API (#3783)Daniel Wirtz2021-04-083-1/+12
| | | | | Adds C/JS APIs for the SIMD instructions * Load32Zero * Load64Zero
* Add new SIMD multiplication instructions to C/JS API (#3782)Daniel Wirtz2021-04-083-2/+78
| | | | | | | | | | | | | | | | Adds C/JS APIs for the SIMD instructions * Q15MulrSatSVecI16x8 * ExtMulLowSVecI16x8 * ExtMulHighSVecI16x8 * ExtMulLowUVecI16x8 * ExtMulHighUVecI16x8 * ExtMulLowSVecI32x4 * ExtMulHighSVecI32x4 * ExtMulLowUVecI32x4 * ExtMulHighUVecI32x4 * ExtMulLowSVecI64x2 * ExtMulHighSVecI64x2 * ExtMulLowUVecI64x2 * ExtMulHighUVecI64x2
* Add new SIMD conversion instructions to C/JS API (#3781)Daniel Wirtz2021-04-083-0/+48
| | | | | | | | | Adds C/JS APIs for the SIMD instructions * ConvertLowSVecI32x4ToVecF64x2 * ConvertLowUVecI32x4ToVecF64x2 * TruncSatZeroSVecF64x2ToVecI32x4 * TruncSatZeroUVecF64x2ToVecI32x4 * DemoteZeroVecF64x2ToVecF32x4 * PromoteLowVecF32x4ToVecF64x2
* Add iNxM.extadd_pairwise_* SIMD instructions to C/JS API (#3780)Daniel Wirtz2021-04-083-1/+32
| | | | | | | Adds C/JS APIs for the SIMD instructions * ExtAddPairwiseSVecI8x16ToI16x8 * ExtAddPairwiseUVecI8x16ToI16x8 * ExtAddPairwiseSVecI16x8ToI32x4 * ExtAddPairwiseUVecI16x8ToI32x4
* Write names subsections by increasing id (#3779)Sam Clegg2021-04-071-27/+33
| | | | | See https://webassembly.github.io/spec/core/appendix/custom.html "Each subsection may occur at most once, and in order of increasing id."
* Add i64x2.extend_low/high_* SIMD instructions to C/JS API (#3778)Daniel Wirtz2021-04-073-0/+32
| | | | | | | Adds C/JS APIs for the SIMD instructions * ExtendLowSVecI32x4ToVecI64x2 * ExtendHighSVecI32x4ToVecI64x2 * ExtendLowUVecI32x4ToVecI64x2 * ExtendHighUVecI32x4ToVecI64x2
* Add various SIMD instructions to C/JS API (#3777)Daniel Wirtz2021-04-073-1/+60
| | | | | | | | | | | | | Adds C/JS APIs for the SIMD instructions * PopcntVecI8x16 * AbsVecI64x2 * AllTrueVecI64x2 * BitmaskVecI64x2 * EqVecI64x2 * NeVecI64x2 * LtSVecI64x2 * GtSVecI64x2 * LeSVecI64x2 * GeSVecI64x2
* [GC] Do not crash on unreasonable GC array allocations in interpreter; trap ↵Alon Zakai2021-04-072-2/+22
| | | | | | | | | | (#3559) The spec does not mention traps here, but this is like a JS VM trapping on OOM - a runtime limitation is reached. As these are not specced traps, I did not add them to effects.h. Note how as a result the optimizer happily optimizes into a nop an unused allocation of an array of size unsigned(-1), which is the behavior we want.
* [RT] Add type to tables and element segments (#3763)Abbas Mashayekh2021-04-0616-90/+222
|
* Emit dollar signs when relevant while debugging s-expression elements (#3693)Alon Zakai2021-04-061-0/+3
| | | | This is just noticeable when debugging locally and doing a quick print to stdout.
* Fuzzing in JS VMs: Emit null for reference type params instead of 0 (#3774)Alon Zakai2021-04-061-4/+8
| | | | VMs will not convert a 0 or undefined from JS into a wasm null reference - it must be null.
* Fuzzing in JS VMs: Print types when we have nothing better (#3773)Alon Zakai2021-04-061-1/+2
| | | | | | | | | | | | | This matches #3747 which makes us not log out reference values, instead we print just their types. This also prints a type for non-reference things, replacing a previous exception, which affects things like SIMD and BigInts, but those trap anyhow at the JS boundary I believe (or did that change for SIMD?). Anyhow, printing the type won't give a false "ok" when comparing wasm2js output to the interpreter, assuming the interpreter prints out a value and not just a type (which is the case). We could try to do better, but this code is on the JS side, where we don't have the type - just a string representation of it, which we'd need to parse etc.
* Reducer: skip more functions when failing to remove them (#3718)Alon Zakai2021-04-051-2/+2
| | | | | | | This avoids an annoying case where in each iteration we try to remove every function one by one and keep failing. Instead, we'll skip large numbers of them when the factor is large at least. Also shorten some unnecessary logging.
* Update SIMD names and opcodes (#3771)Thomas Lively2021-04-0525-1308/+812
| | | | Also removes experimental SIMD instructions that were not included in the final spec proposal.
* Reorder global definitions in Print pass (#3770)Abbas Mashayekh2021-04-021-2/+2
| | | | This is needed to make sure globals are printed before element segments, where `global.get` can appear both as offset and an expression.
* Fix an iterator invalidation error in the fuzzer (#3764)Alon Zakai2021-04-011-2/+8
|
* Fix type canonicalization bugs (#3761)Thomas Lively2021-04-011-79/+225
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When canonical heap types were already present in the global store, for example during the --roundtrip pass, type canonicalization was not working correctly. The issue was that the GlobalCanonicalizer was replacing temporary HeapTypes with their canonical equivalents one type at a time, but the act of replacing a temporary HeapType use with a canonical HeapType use could change the shape of later HeapTypes, preventing them from being correctly matched with their canonical counterparts. This PR fixes that problem by computing all the temporary-to-canonical heap type replacements before executing them. To avoid a similar problem when canonicalizing Types, one solution would have been to pre-calculate the replacements before executing them just like with the HeapTypes, but that would have required either complex bookkeeping or moving temporary Types into the global store when they are first canonicalized. That would have been complicated because unlike for temporary HeapTypeInfos, the unique_pointer to temporary TypeInfos is not readily available. This PR instead switches back to using pointer-identity based equality and hashing for TypeInfos, which works because we only ever canonicalize Types with canonical children. This change should be a nice performance improvement as well. Another bug this PR fixes is that shape hashing and equality considered BasicKind HeapTypes to be different from their corresponding BasicHeapTypes, which meant that canonicalization could produce different types for the same type definition depending on whether the definition used a TypeBuilder or not. The fix is to pre-canonicalize BasicHeapTypes (and Types that have them as children) during shape hashing and equality. The same mechanism is also used to simplify Store's canonicalization. Fixes #3736.