summaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* HeapStoreOptimization: Fix a bug with jumping from the later value (v2) (#7070)Alon Zakai2024-11-121-3/+76
| | | | | | | | | | | | | | | | | | | | | | | | | | This PR fixes this situation: (block $out (local.set $x (struct.new X Y Z)) (struct.set $X 0 (local.get $x) (..br $out..)) ;; X' here has a br ) (local.get $x) => (block $out (local.set $x (struct.new (..br $out..) Y Z)) ) (local.get $x) We want to fold the struct.set into the struct.new, but the br is a problem: if it executes then we skip the struct.set, and the last local.get in fact reads the struct before the write. And, if we did this optimization, we'd end up with the br on the struct.new, so it would skip that instruction and even the local.set. To fix this, we use the new API from #7039, which lets us query, "is it ok to move the local.set to where the struct.set is?"
* [wasm64] Fuzzer: Fix type of unimported offsets (#7071)Alon Zakai2024-11-111-2/+2
| | | | | | When the fuzzer sees an imported segment, it makes it non-imported (because imported ones would trap when we tried to run them: we don't have the normal runtime they expect). We had hardcoded i32 offets there, which need to be generalized.
* Fix PickLoadSigns on SignExt feature instructions (#7069)Alon Zakai2024-11-111-17/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I believe the history here is that 1. We added a PickLoadSigns pass. It checks if a load from memory is stored in a local that is only every used in a signed or an unsigned manner. If it is, we can adjust the sign of the load (load8_u/s) to do the sign/unsign during the load. 2. The pass finds each LocalGet and looks either 2 or 3 parents above it. For a sign operation, we need to look up 3, since the operation is x << K >> K. For an unsigned, we need only 2, since we have x & M. We hardcoded those numbers 2 and 3. 3. We added the SignExt feature, which adds i32.extend8_s. This does a sign extend with a single instruction, not two nested ones, so now we can sign- extend at depth 2, unlike before. Properties::getSignExtValue was updated for this, but not the pass PickLoadSigns. The bug that is fixed here is that we looked at depth 3 for a sign-extend, and we blindly accepted it if we found one. So we ended up accepting (i32.extend8_s (ANYTHING (x))), which is a sign-extend of something, but not of x, which is bad. We were also missing an optimization opportunity, as we didn't look for depth 2 sign extends. This bug is quite old, from when Properties got SignExt support, in #3910. But the blame isn't there - to notice this then, we'd have had to check each caller of getSignExtValue throughout the codebase, which isn't reasonable. The fault is mine, from the first write-up of PickLoadSigns in 2017: the code should have been fully general, handling 2/3 and checking the output when it does so (adding == curr, that the sign/zero-extended value is the one we expect). That is what this PR does.
* LocalGraph::canMoveSet (#7039)Alon Zakai2024-11-112-41/+203
| | | | | This new API lets us ask if a set can be safely moved to a new position. The new position must be the location of an expression from a particular class (this allows us to populate the IR once and then query any of those locations).
* [EH] Fuzz calls from JS by calling wasm exports, sometimes catching (#7067)Alon Zakai2024-11-083-5/+136
| | | | | | | | | | | | | | | | This adds two new imports to fuzzer modules: * call-export, which gets an export index and calls it. * call-export-catch, which does the call in a try-catch, swallowing any error, and returning 1 if it saw an error. The former gives us calls back into the wasm, possibly making various trips between wasm and JS in interesting ways. The latter adds a try-catch which helps fuzz wasm EH. We do these calls using a wasm export index, i.e., the index in the list of exports. This is simple, but it does have the downside that it makes executing the wasm sensitive to changes in exports (e.g. wasm-merge adds more), which requires some handling in the fuzzer.
* [wasm64] Fix 32-bit address computation in execution of SIMDLoadExtend (#7068)Alon Zakai2024-11-081-3/+6
|
* Rename indexType -> addressType. NFC (#7060)Sam Clegg2024-11-0729-214/+223
| | | See https://github.com/WebAssembly/memory64/pull/92
* [wasm64] Fix copying of 64-bit tables, and fuzz them (#7065)Alon Zakai2024-11-072-2/+21
| | | | `ModuleUtils::copyTable` was not copying the `indexType` property.
* [wasm64] Fuzz wasm64 memories (#7064)Alon Zakai2024-11-072-8/+27
| | | | | | | * Remove the code that prevented fuzzing wasm64 test files. * Ignore a run that hits the V8 implementation limit on memory size. * Disable wasm64 fuzzing in wasm2js (like almost all post-MVP features). * Add fuzzer logic to emit a 64-bit memory sometimes. * Fix various places in the fuzzer that assumed 32-bit indexes
* [wasm64] Fix Directize on indexes > 32 bits (#7063)Alon Zakai2024-11-071-1/+1
|
* [wasm64] Make interpreter table methods operate on Address, not Index (#7062)Alon Zakai2024-11-074-29/+23
| | | This allows 64-bit bounds checking to work properly.
* [wasm64] Fix wasm-ctor-eval + utils on 64-bit indexes for memory64 (#7059)Alon Zakai2024-11-062-5/+12
| | | | Some places assumed a 32-bit index.
* [wasm64] Fix 64-bit memory/table operations in interpreter (#7058)Alon Zakai2024-11-061-9/+14
| | | A bunch of places assumed a 32-bit index.
* [wasm64] Handle 64-bit overflow in optimizeMemoryAccess (#7057)Alon Zakai2024-11-061-2/+7
| | | | | When we combine a load/store offset with a const, we must not overflow, as the semantics of offsets do not wrap.
* [GC] Fix ConstantFieldPropagation on incompatible types (#7054)Alon Zakai2024-11-051-1/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | CFP is less precise than GUFA, in particular, when it flows around types then it does not consider what field it is flowing them to, and its core data structure is "if a struct.get is done on this type's field, what can be read?". To see the issue this PR fixes, assume we have A / \ B C Then if we see struct.set $C, we know that can be read by a struct.get $A (we can store a reference to a C in such a local/param/etc.), so we propagate the value of that set to A. And, in general, anything in A can appear in B (say, if we see a copy, a struct.set of struct.get that operates on types A, then one of the sides might be a B), so we propagate from A to B. But now we have propagated something from C to B, which might be of an incompatible type. This cannot cause runtime issues, as it just means we are propagating more than we should, and will end up with less-useful results. But it can break validation if no other value is possible but one with an incompatible type, as we'd replace a struct.get $B with a value that only makes sense for C. (The qualifier "no other value is possible" was added in the previous sentence because if another one is possible then we'd end up with too many values to infer anything, and not optimize at all, avoiding any error.)
* Remove FeaturePrefix::FeatureRequired (NFC) (#7034)Heejin Ahn2024-11-042-11/+3
| | | | | | | | This has not been emitted in LLVM since https://github.com/llvm/llvm-project/commit/3f34e1b883351c7d98426b084386a7aa762aa366. The corresponding proposed tool-conventions change: https://github.com/WebAssembly/tool-conventions/pull/236
* [GC] Fix GlobalTypeOptimization logic for public types handling (#7051)Alon Zakai2024-11-041-7/+18
| | | | | | | | | | | | | This fixes a regression from #7019. That PR fixed an error on situations with mixed public and private types, but it made us stop optimizing in valid cases, including cases with entirely private types. The specific regression was that we checked if we had an entry in the map of "can become immutable", and we thought that was enough. But we may have a private child type with a public parent, and still be able to optimize in the child if the field is not present in the parent. We also did not have exhaustive checking of all the states canBecomeImmutable can be, so add those + testing.
* Make 32-bit hashing identical to 64-bit in TypeSSA (#7048)Alon Zakai2024-11-042-13/+19
| | | | | | | | | | | This is NFC on 64-bit systems but noticeable on 32. Also remove the 32-bit path in hash_combine. That isn't necessary for this fix, but it makes the code simpler and also makes debugging between systems simpler. It might also avoid problems in future cases, if we are lucky. The only cost is perhaps a slight slowdown on 32-bit systems, which seems worth it. Fixes #7046
* Module splitting: don't create new tables when splitting with Emscripten (#7050)Derek Schuff2024-11-022-7/+19
| | | | | | | | Emscripten's JS loader code for wasm-split isn't prepared for handling multiple tables that binaryen automatically creates when reference types are enabled (especially in conjunction with dynamic loading). For now, disable creation of multiple tables when using Emscripten's table ABI (distinguished by importing or exporting a table named "__indirect_function_table".
* [NFC] Use RAII to manage call depth tracking in the interpreter (#7049)Alon Zakai2024-11-013-29/+12
| | | | | | | The old code manually managed it for no good reason that I can see. After this, there is no difference between callFunction and callFunctionInternal, so fold them together.
* Fuzz the Table from JS (#7042)Alon Zakai2024-10-313-6/+117
| | | | | Continues the work from #7027 which added throwing from JS, this adds table get/set operations from JS, to further increase our coverage of Wasm/JS interactions (the table can be used from both sides).
* Require reference-types in addition to bulk-memory for table.fill (#7040)daxpedda2024-10-311-2/+4
| | | | table.fill was introduced by the reference-types proposal (but also, only makes sense among the other bulk memory operations, so require both).
* [NFC] Fix copy-paste error in TryTable printing (#7044)Alon Zakai2024-10-311-1/+1
|
* Don't strip target features in wasm-emscripten-finalize (#7043)Derek Schuff2024-10-301-2/+0
| | | | | This makes the behavior consistent with emcc builds where we don't run finalization, and potentially makes testing and debugging easier. Emscripten still strips the target features section when optimizing.
* [NFC] Use more precise types for Expression IDs (#7038)Alon Zakai2024-10-302-5/+4
| | | | | | | | | | Make the ID enum an `int8_t`, and make the Specific ID a `constexpr` of that type. This seems more idiomatic and makes some code simpler, see the change to `find_all.h` which no longer needs a cast to compile. This has no performance impact.
* [GC] Fix handling of public types in TypeRefining (#7037)Alon Zakai2024-10-291-5/+21
|
* [GC] RemoveUnusedBrs: Ensure refining of BrOnCast's castType does not ↵Alon Zakai2024-10-291-0/+26
| | | | | | | | unrefine the output (#7036) Paradoxically, when a BrOn's castType is refined, its own type (the type it flows out) can get un-refined: making the castType non-nullable means nulls no longer flow on the branch, so they may flow out directly, making the BrOn nullable.
* Fix Apline compile error on uninitialized value (#7035)Alon Zakai2024-10-281-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Similar to * https://github.com/WebAssembly/binaryen/pull/6330 * https://github.com/WebAssembly/binaryen/issues/6311 * https://github.com/WebAssembly/binaryen/pull/6912 * https://github.com/WebAssembly/binaryen/issues/5946 This extends the region we ignore the gcc warning in. The warning: ninja: job failed: /usr/bin/c++ -I/src/src -I/src/third_party/FP16/include -I/src/third_party/llvm-project/include -I/src -static -DBUILD_LLVM_DWARF -Wall -Werror -Wextra -Wno-unused-parameter -Wno-dangling-pointer -fno-omit-frame-pointer -fno-rtti -Wno-implicit-int-float-conversion -Wno-unknown-warning-option -Wswitch -Wimplicit-fallthrough -Wnon-virtual-dtor -fPIC -fdiagnostics-color=always -O3 -DNDEBUG -UNDEBUG -std=c++17 -MD -MT src/passes/CMakeFiles/passes.dir/Precompute.cpp.o -MF src/passes/CMakeFiles/passes.dir/Precompute.cpp.o.d -o src/passes/CMakeFiles/passes.dir/Precompute.cpp.o -c /src/src/passes/Precompute.cpp In file included from /src/src/literal.h:27, from /src/src/wasm.h:36, from /src/src/ir/boolean.h:20, from /src/src/ir/bits.h:20, from /src/src/ir/properties.h:20, from /src/src/ir/iteration.h:20, from /src/src/passes/Precompute.cpp:30: In copy constructor 'wasm::SmallVector<T, N>::SmallVector(const wasm::SmallVector<T, N>&) [with T = wasm::Expression*; long unsigned int N = 10]', inlined from 'constexpr std::pair<_T1, _T2>::pair(const _T1&, const _T2&) [with _U1 = wasm::Select* const; _U2 = wasm::SmallVector<wasm::Expression*, 10>; typename std::enable_if<(std::_PCC<true, _T1, _T2>::_ConstructiblePair<_U1, _U2>() && std::_PCC<true, _T1, _T2>::_ImplicitlyConvertiblePair<_U1, _U2>()), bool>::type <anonymous> = true; _T1 = wasm::Select* const; _T2 = wasm::SmallVector<wasm::Expression*, 10>]' at /usr/include/c++/13.2.1/bits/stl_pair.h:559:21, inlined from 'T& wasm::InsertOrderedMap<Key, T>::operator[](const Key&) [with Key = wasm::Select*; T = wasm::SmallVector<wasm::Expression*, 10>]' at /src/src/support/insert_ordered.h:112:29, inlined from 'void wasm::Precompute::partiallyPrecompute(wasm::Function*)::StackFinder::visitSelect(wasm::Select*)' at /src/src/passes/Precompute.cpp:571:24, inlined from 'static void wasm::Walker<SubType, VisitorType>::doVisitSelect(SubType*, wasm::Expression**) [with SubType = wasm::Precompute::partiallyPrecompute(wasm::Function*)::StackFinder; VisitorType = wasm::Visitor<wasm::Precompute::partiallyPrecompute(wasm::Function*)::StackFinder, void>]' at /src/src/wasm-delegations.def:50:1: /src/src/support/small_vector.h:69:35: error: '<unnamed>.wasm::SmallVector<wasm::Expression*, 10>::fixed' may be used uninitialized [-Werror=maybe-uninitialized] 69 | : usedFixed(other.usedFixed), fixed(other.fixed), flexible(other.flexible) { | ^~~~~~~~~~~~~~~~~~ In file included from /src/src/passes/Precompute.cpp:37: /src/src/support/insert_ordered.h: In static member function 'static void wasm::Walker<SubType, VisitorType>::doVisitSelect(SubType*, wasm::Expression**) [with SubType = wasm::Precompute::partiallyPrecompute(wasm::Function*)::StackFinder; VisitorType = wasm::Visitor<wasm::Precompute::partiallyPrecompute(wasm::Function*)::StackFinder, void>]': /src/src/support/insert_ordered.h:112:29: note: '<anonymous>' declared here 112 | std::pair<const Key, T> kv = {k, {}}; | ^~
* Fix typo in parsers.h (#7032)Angela Upreti2024-10-251-1/+1
| | | Corrected `maybeRefType` declaration to `maybeReftype`.
* Fix TypeMerging bug with indirectly reachable public types (#7031)Thomas Lively2024-10-241-5/+13
| | | | | | | | | | | | | | | | | | | TypeMerging works by representing the type definition graph as a partitioned DFA and then refining the partitions to find mergeable types. #7023 was due to a bug where the DFA included edges from public types to their children, but did not necessarily include corresponding states for those children. One way to fix the bug would have been to traverse the type graph, finding all reachable public types and creating DFA states for them, but that might be expensive in cases where there are large graphs of public types. Instead, fix the problem by removing the edges from public types to their children entirely. Types reachable from public types are also public and therefore are not eligible to be merged, so these edges were never necessary for correctness. Fixes #7023.
* [EH] Fuzz throws from JS (#7027)Alon Zakai2024-10-233-38/+85
| | | | | | | | | | | We already generated (throw ..) instructions in wasm, but it makes sense to model throws from outside as well, as they cross the module boundary. This adds a new fuzzer import to the generated modules, "throw", that just does a throw from JS etc. Also be more precise about handling fuzzing-support imports in fuzz-exec: we now check that logging functions start with "log*" and error otherwise (this check is now needed given we have "throw", which is not logging). Also fix a minor issue with name conflicts for logging functions by using getValidFunctionName for them, both for logging and for throw.
* [GC] Fix assertion in GlobalTypeOptimization about public super (#7026)Alon Zakai2024-10-221-9/+4
| | | | | | | | We only checked for the case of the immediate super being public while we are private, but it might be a grandsuper instead. That is, any ancestor that is public will prevent GTO from removing a field (since we can only add fields on top of our ancestors). Also, the ancestors might not all have the field, which would add more complexity to that particular assertion, so just remove it, and add comprehensive tests.
* Remove closed world validation checks (#7019)Alon Zakai2024-10-184-58/+25
| | | | | | | | | | | These were added to avoid common problems with closed world mode, but in practice they are causing more harm than good, forcing users to work around them. In the meantime (until #6965), remove this validation to unblock current toolchain makers. Fix GlobalTypeOptimization and AbstractTypeRefining on issues that this uncovers: without this validation, it is possible to run them on more wasm files than before, hence these were not previously detected. They are bundled in this PR because their tests cannot validate before this PR.
* [GC] Ignore public types in SignaturePruning (#7018)Alon Zakai2024-10-181-15/+6
| | | | | | | | | | Similar to #7017 . As with that PR, this reduces some optimizations that were valid, as we tried to do something complex here and refine types in a public rec group when it seemed safe to do so, but our analysis was incomplete. The testcase here shows how another operation can end up causing a dependency that breaks things, if another type that uses one that we modify is public. To be safe, ignore all public types. In the future perhaps we can find a good way to handle "almost-private" types in public rec groups, in closed world.
* [GC] Ignore public types in SignatureRefining (#7022)Alon Zakai2024-10-181-12/+5
| | | Similar to #7017 and #7018
* [EH] Add TryTable to StripEH (#7020)Alon Zakai2024-10-181-0/+5
|
* [GC] Ignore public types in GlobalTypeOptimization (#7017)Alon Zakai2024-10-171-3/+16
| | | | | | TypeUpdater which it uses internally already does so, but we must also ignore such types earlier, and make no other modifications to them. Helps #7015
* [EH][GC] Send a non-nullable exnref from TryTable (#7013)Alon Zakai2024-10-173-5/+11
| | | | | | | | | | | | | | | When EH+GC are enabled then wasm has non-nullable types, and the sent exnref should be non-nullable. In BinaryenIR we use the non- nullable type all the time, which we also do for function references and other things; we lower it if GC is not enabled to a nullable type for the binary format (see `WasmBinaryWriter::writeType`, to which comments were added in this PR). That is, this PR makes us handle exnref the same as those other types. A new test verifies that behavior. Various existing tests are updated because ReFinalize will now use the more refined type, so this is an optimization. It is also a bugfix as in #6987 we started to emit the refined form in the fuzzer, and this PR makes us handle it properly in validation and ReFinalization.
* [EH][GC] Add missing subtyping constraints from TryTable (#7012)Alon Zakai2024-10-161-1/+7
| | | | | Similar to Break, BrOn, etc., we must apply subtyping constraints of the types we send to blocks, so that Unsubtyping will not remove subtypings that are actually needed.
* [NFC] Add validation checks in OptUtils::optimizeAfterInlining (#7009)Alon Zakai2024-10-161-5/+20
| | | | | | | This can help find errors in the middle of passes like Inlining, that do multiple cycles and include optimizations in the middle. We do this in BINARYEN_PASS_DEBUG >= 2 to avoid slowing down the timing reports in 1.
* [Wasm GC] Fuzz BrOn (#7006)Alon Zakai2024-10-162-6/+119
|
* [NFC] Remove unused, ancient file wasm-module-building.h (#7010)Alon Zakai2024-10-161-316/+0
| | | | This was used in asm2wasm (the asm.js to wasm compiler, used in fastcomp, before the LLVM wasm backend replaced it).
* GlobalRefining: Do not refine mutable exported globals (#7007)Alon Zakai2024-10-151-2/+9
| | | | | A mutable exported global might be shared with another module which writes to it using the current type, which is unsafe and the type system does not allow, so do not refine there.
* [Strings] StringGathering: Handle uses of strings before their definitions ↵Alon Zakai2024-10-151-10/+8
| | | | | | | | | | (#7008) When we gather strings, we create new globals for each one, that is then the canonical defining global for it, which will then be used everywhere else. We create such a global if we lack one, but if we happen to have such a global - a global that simply defines a string - then we reuse it. But we didn't handle the case where there was a use before the definition, and failed to sort the definition before the use.
* [WasmGC] OptimizeInstructions: Cancel out internalize+externalize pairs (#7005)Alon Zakai2024-10-141-1/+11
|
* [Wasm EH] Optimize away _ref from try_table catches when unused (#6996)Alon Zakai2024-10-141-4/+52
| | | | | | | | | | | | | If we have (drop (block $b (result exnref) (try_table (catch_all_ref $b) then we don't really need to send the ref: it is dropped, so we can just replace catch_all_ref with catch_all and then remove the drop and the block value. MergeBlocks already had logic to remove block values, so it is the natural place to add this.
* [WasmGC] OptimizeInstructions: Reorder externalize/internalize operations ↵Alon Zakai2024-10-141-2/+21
| | | | | | | | | | with ref.as_non_null (#7004) (any.convert_extern/extern.convert_any (ref.as_non_null ..)) => (ref.as_non_null (any.convert_extern/extern.convert_any ..)) This then allows the RefAsNonNull to be combined with parents in some cases (whereas the reverse allows nothing).
* Optimize Module::get_* family of functions with std::string_view in ↵Petr Makhnev2024-10-101-1/+1
| | | | | | | | | | | | getModuleElement (#6998) Passing a constant string to functions requires memory allocation, and allocation is inherently slow. Since we are using C++17, we can use string_view and remove this unnecessary allocation. Although the code seems simple enough for the optimizer to remove this allocation after inlining, tests on Clang 18 show that this is not the case (on Apple Silicon at least).
* [Wasm EH] Optimize values flowing out of TryTable (#6997)Alon Zakai2024-10-101-4/+5
| | | | | | | | | | | | | | | | | | | | | | This allows (block $out (result i32) (try_table (catch..) .. (br $out (i32.const 42) ) ) ) => (block $out (result i32) (try_table (result i32) (catch..) ;; add a result .. (i32.const 42) ;; remove the br around the value ) )
* ReFinalize in MergeBlocks so we can optimize unreachable instructions too ↵Alon Zakai2024-10-101-25/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | (#6994) In #6984 we optimized dropped blocks even if they had unreachable code. In #6988 that part was reverted, and blocks with unreachable code were ignored once more. However, I realized that the check was not actually for unreachable code, but for having an unreachable child, so it would miss things like this: (block (block .. (br $somewhere) ;; unreachable type, but no unreachable code ) ) But it is useful to merge such blocks: we don't need the inner block here. To fix this, just run ReFinalize if we change anything, which will propagate unreachability as needed. I think MergeBlocks was written before we had that utility, so it didn't use it... This is not only useful for itself but will unblock an EH optimization in a later PR, that has code in this form. It also simplifies the code by removing the hasUnreachableChild checks.
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-05 15:17:20 +0000