Bug 1539806 - Use zydis to disassemble cranelift code. r=bbouvier This performs the actual disassembly by calling the disassembler from Cranelift. Since the disassembler emits to a buffer we can use the jitspew for printing, thus we get output-to-file etc for free. Differential Revision: https://phabricator.services.mozilla.com/D27852

Bug 1556641 - mach vendor rust. r=bbouvier Pull in file changes after re-pointing cranelift to current HEAD. Differential Revision: https://phabricator.services.mozilla.com/D33599

Bug 1556641 - Re-point cranelift to current HEAD. r=bbouvier We need this to be able to land the second half of the jump tables patch, since cranelift APIs have changed. Differential Revision: https://phabricator.services.mozilla.com/D33598

Bug 1547752 - Support jump tables in cranelift. r=bbouvier This patch uses the machinery submitted in https://github.com/CraneStation/cranelift/pull/774 to split the jump table (and any other read-only data) apart from the compiled code, so as to make room for the epilogue and proper alignment. The only difficult part about this is to update the instructions referencing the tables, and the table entries, when the tables are moved. Differential Revision: https://phabricator.services.mozilla.com/D32458

Bug 1554080 part 5 - Replace the masm.loadJitCodeNoArgCheck in GenerateImportJitExit with a TLS load. r=bbouvier This way we have two loads instead of three. Differential Revision: https://phabricator.services.mozilla.com/D32445

Bug 1554080 part 4 - Store JitScript* instead of BaselineScript* in FuncImportTls. r=bbouvier This has a few benefits: * Less toggling when we discard/reallocate the BaselineScript without discarding the JitScript. * Wasm's JIT exit optimization will work with the Baseline Interpreter in the future. * The next part will use this to eliminate a load. Differential Revision: https://phabricator.services.mozilla.com/D32444

Bug 1554080 part 3 - Use UniquePtr for BaselineScript::dependentWasmImports_. r=bbouvier Differential Revision: https://phabricator.services.mozilla.com/D32443

Bug 1554080 part 2 - Allow Wasm FFI calls to lazy link stub. r=bbouvier The lazy link stub used to assume a JIT caller but this is no longer the case. We can then fold clearDependentWasmImports into unlinkDependentWasmImports. Differential Revision: https://phabricator.services.mozilla.com/D32442

Bug 1554080 part 1 - Move jitCodeSkipArgCheck_ from JSScript to JitScript. r=bbouvier,iain This removes a word from JSScript and corresponding Wasm data structures. Furthermore, the skip-argument-type-checks optimization depends on JitScript's lifetime so moving it to JitScript feels right and might help catch bugs. Differential Revision: https://phabricator.services.mozilla.com/D32441

Bug 1554111 - Add js/src/wasm/cranelift/src/ to the rustfmt list r=bbouvier Differential Revision: https://phabricator.services.mozilla.com/D32437

Bug 1554053 - Wasm via Cranelift: size of interrupt check comparison is incorrect. r=bbouvier This patch changes Wasm-via-CL to always use a 32-bit comparison for interrupt checks. Wasm-via-Cranelift generates code to do interrupt checks by doing a machine-word sized comparison. However, the compared-against value, TlsData::interrupt, is an Atomic<uint32_t, mozilla::Relaxed>, and so the comparison is incorrect on all 64 bit targets: it also compares the 4 bytes following TlsData::interrupt, which look to me as if they are an alignment hole (iow, junk). This is obviously incorrect, and it's observably inconsistent with what the -via-Ion and -baseline routes do, which is to always generate a 32-bit comparison. It also holds a potential danger of a store-forwarding stall (big read after small write), although, based on the struct layout and detailed reading of the Intel opt guide, I think it's probably harmless for the Intel Core architecture family. Differential Revision: https://phabricator.services.mozilla.com/D32421

Bug 1544041 - Add test-also support to wpt-in-jstests; r=bbouvier Differential Revision: https://phabricator.services.mozilla.com/D27478

Bug 1544041 - Add test-also support to wpt-in-jstests; r=bbouvier Differential Revision: https://phabricator.services.mozilla.com/D27478

Bug 1544383 - Fix WebAssembly class init in fuzzing target. r=bbouvier Differential Revision: https://phabricator.services.mozilla.com/D27486

Bug 1538465 - WebAssembly Fuzzing Target. r=bbouvier Differential Revision: https://phabricator.services.mozilla.com/D25919

Bug 1538465 - WebAssembly Fuzzing Target. r=bbouvier Differential Revision: https://phabricator.services.mozilla.com/D25919

Bug 1529957 - Baldr: don't accept asm.js functions for table elements (r=bbouvier) Differential Revision: https://phabricator.services.mozilla.com/D25011

Bug 1529957 - Baldr: create lazy stubs even more lazily (r=bbouvier) Differential Revision: https://phabricator.services.mozilla.com/D25010

Bug 1529957 - Baldr: don't require WASM_CODEGEN_DEBUG for JitOptions that disable opts (r=bbouvier) Differential Revision: https://phabricator.services.mozilla.com/D25008

Bug 1529957 - Baldr: allow wasm functions to have func indices (r=bbouvier) Differential Revision: https://phabricator.services.mozilla.com/D25007

Bug 1529681 - Update bindgen. r=bbouvier This works around an LLVM bug and also pulls a fair amount of bugfixes and perf improvements. None of the breaking changes affect either the style system or cranelift stuff. Changelog for convenience: https://github.com/rust-lang/rust-bindgen/compare/v0.43.2...v0.49.0 Differential Revision: https://phabricator.services.mozilla.com/D20899

Bug 1535609 - Root pointer args in callExport. r=bbouvier In the slow callExport path, we convert arguments left-to-right and these conversions can both OOM and error out for other reasons, and they may perform various computations, notably allocation. Therefore any reference arguments must be rooted until all the conversions are finished. However, the arguments are computed into a plain Vector<> whose layout we need to control tightly and whose elements are not easily rootable. So we keep a separate rooted vector of reference values and when we encounter a reference argument we push that argument onto this, and before the actual call we move the reference values (which may have been altered by GC) into the argument array; this copying is atomic with respect to gc + the invocation, and once we're in the callee the normal rooting logic (via stackmaps) takes over. Differential Revision: https://phabricator.services.mozilla.com/D24061

Bug 1533932 - Handle prebarriers properly for wasm tables. r=bbouvier Two problems needed to be fixed: - JS::Heap<> only has a postbarrier, not a prebarrier also; this is what triggered the original error report. The type in table-of-anyref therefore needs to be js::HeapPtr<>, so that we get both barriers. (It can't be GCPtr because the vector storage may be moved as the table grows.) - The API for table.get returns a pointer into underlying vector storage or null; if not null, the pointer must be dereferenced to obtain the actual value. Since the vector storage may move during GC and grow operations the pointer is really only valid until the next operation that might move the vector. That lifetime restriction was not enforced in Ion-generated code and the dereference could in principle move far enough during optimization for it to become invalid, though in practice it is extremely unlikely that this was actually a problem. We fix this by flagging the dereference as non-movable, and by changing some names and comments to highlight the issue. Differential Revision: https://phabricator.services.mozilla.com/D23665

Bug 1529691 - use futures in order to process in parallel clang-format. r=bbouvier Parts of this patch were taken from the original work of :bbouvier in Bug 1521772. We needed to revert Bug 1521772 since it broken Windows compatibility. Differential Revision: https://phabricator.services.mozilla.com/D23100

Bug 1490048 - add cranelift to raptor wasm-misc and wasm-godot tests. r=bbouvier,rwood add cranelift to raptor wasm-misc and wasm-godot tests. Differential Revision: https://phabricator.services.mozilla.com/D23144

Bug 1532851 - Unbreak BSDs build on powerpc64 after bug 1462566. r=bbouvier Define R32_sig, R01_sig based on: https://github.com/openbsd/src/blob/master/sys/arch/powerpc/include/signal.h https://github.com/netbsd/src/blob/trunk/sys/arch/powerpc/include/mcontext.h https://github.com/freebsd/freebsd/blob/master/sys/powerpc/include/ucontext.h

Bug 1531731 - Register MWasmLoadRef and MWasmStoreRef with AliasAnalysis. r=bbouvier These new nodes participate in alias analysis and so must be made known to the alias analysis framework. Differential Revision: https://phabricator.services.mozilla.com/D21681

Bug 1531670 - Replace ENABLE_WASM_GENERALIZED_TABLES. r=bbouvier Replace all uses of ENABLE_WASM_GENERALIZED_TABLES with ENABLE_WASM_REFTYPES, plus some knock-on effects. Replace all uses of wasmGeneralizedTables with wasmReftypesEnabled. Drive-by fix: replace 'anyfunc' in a couple of error strings with the canonical 'funcref'. Drive-by fix: remove isSimdAvailable, it is not used and we have no SIMD. Differential Revision: https://phabricator.services.mozilla.com/D21653

Bug 1524923 - Support local.get, local.set, global.get, global.set. r=bbouvier I've only added support for these, renamed in a couple of error messages and a few test cases, not renamed all the uses, because there are so many. Will file followup bugs for that work, but it won't be urgent. Note, wabt no longer recognizes get_local et al, it requires local.get etc. But we should remain backward compatible for a long while still. Differential Revision: https://phabricator.services.mozilla.com/D21502

Bug 1530273 - Make 'funcref' the canonical name. r=bbouvier Wabt is now supporting funcref exclusively, and with the reftypes proposal I think there's broad agreement that we will stop using anyfunc. So let's accept funcref both in the text format and in the table creation dictionary, and let's use this name as the canonical name in error messages and similar. But let's also continue to accept anyfunc, since there may be in-flight tests and other content that uses it. This includes a couple of emscripten-compiled benchmarks currently in the repo; I chose not to change those. Differential Revision: https://phabricator.services.mozilla.com/D21388

Bug 1515917 - Multiple test-also flags + fix disablement tests. r=bbouvier Allowing test-also to take multiple flags improves test coverage since we can test eg --wasm-gc --wasm-compiler=ion. Doing so uncovered some weaknesses in the tests that test what happens when features are disabled either by configuration or by flag, so this patch also fixes those problems and comments them more carefully." Differential Revision: https://phabricator.services.mozilla.com/D21180

Bug 1529681 - Update bindgen. r=bbouvier

Bug 1529681 - Update bindgen. r=bbouvier This works around an LLVM bug and also pulls a fair amount of bugfixes and perf improvements. None of the breaking changes affect either the style system or cranelift stuff. Changelog for convenience: https://github.com/rust-lang/rust-bindgen/compare/v0.43.2...v0.47.2 Differential Revision: https://phabricator.services.mozilla.com/D20899

Bug 1529349 - Baldr: detect invalid section before code section during streaming compilation (r=bbouvier)

Bug 1520931 - Baldr: another follow-up simplification from asm.js caching removal (r=bbouvier)

Bug 1466464 - rename grow_memory and current_memory. r=bbouvier Rename the uses of current_memory and grow_memory in wasm text content as memory.size and memory.grow, since these are canonical. Rename GrowMemory as MemoryGrow and CurrentMemory as MemorySize everywhere in C++ source code, in honor of their new .wat names -- consistency is good. I chose "Memory" over "Mem" because I like the longer name better, and I think we should rename uses of "Mem" as "Memory" (but not in this patch). Also handle some similar cases, like the growMemory_i32 and currentMemory_i32 Instance methods. Note a couple of changes in cranelift. I did not remove support for the old .wat names yet, I figure we can do that some other year, if ever. Differential Revision: https://phabricator.services.mozilla.com/D19816

Bug 1526579 - Rabaldr arm64 stack alignment fix. r=bbouvier Problem: When a stack chunk had to be popped as part of a control flow instruction, the amount to pop was not always computed as a multiple of ChunkSize. The reason is that the fixed amount of stack that should not be popped isn't necessarily a multiple of ChunkSize, yet this was assumed. A small adjustment to the calculation fixes that. Also added an assertion that would have caught this problem more easily. Also did some desirable drive-by fixes to clarify documentation and to factor the resulting code. The TC sets up a situation where we require a chunk to be created and then destroyed in the 'else' arm of the 'if', at the same time as the fixed amount of stack is not a multiple of ChunkSize. Differential Revision: https://phabricator.services.mozilla.com/D19470

Bug 1520931 - Remove nestedShell() testing function (r=bbouvier)

Bug 1520931 - Remove asm.js cache hooks JS API (r=bbouvier)

Bug 1522298 - ARM64: Ensure that the emulated stack pointer is restored when returning from WASM. r=bbouvier,sstangl Differential Revision: https://phabricator.services.mozilla.com/D19185

Bug 1521939 - Correct the offset for reading stack args on ARM64. r=bbouvier In the optimized stub, we forgot to account for the frameAlignExtra word when computing the offset from the SP at which stack args are read. The test case finds the problem on the ARM64 simulator, and does not need any special parameters, just to run long enough for a JS JIT to kick in. Also a drive-by fix for an incorrect NaN canonicalization along the non-toValue path, cf the Double case right above it. This code changed recently when I introduced the ScratchFloat32Scope, but the bug predates that. Differential Revision: https://phabricator.services.mozilla.com/D18942

Bug 1524256 - Remove two copies of wast.js; r=bbouvier

Bug 1522499 - Allow normal OOM in gc/bug-1214781.js. r=bbouvier Differential Revision: https://phabricator.services.mozilla.com/D17517

Bug 1515917 - Generalize testing for wasm GC availability. r=bbouvier Generalize the testing of GC availability so that it more accurately reflects whether GC support is actually available, this is a complicated predicate at present. (This was motivated by an attempt to generalize the testing directives, but that generalization does not land yet because it has some obscure effects that need to be addressed first.) The generalization sets us up for splitting apart the code and test cases for the "reftypes" and "gctypes" proposals in a subsequent patch.

Bug 1511429 - Run a test only if no JS jit compilation. r=bbouvier We're looking for a specific stack layout here and we'll not run the test if there are jits that may upset the stack. (The alternative would be to add more stack candidates but since we're really only interested in testing write wasm barrier functionality that's not necessary.)

Bug 1508665 - Split BaseStackFrame to simplify it. r=bbouvier BaseStackFrame is split into two parts: - BaseStackFrameAllocator is now responsible for dealing with stack allocation and deallocation in all complex cases (which means everything except for the simple native masm.Push and masm.Pop cases). - What's left of BaseStackFrame is then a simple-to-use API for the rest of the compiler that maintains and checks invariants and does various kinds of bookkeeping and hides the remaining differences between the chunky and non-chunky stacks. The latter class inherits from the former because this is simplest (and it's easy to accomplish with 'protected'). There are a couple of minor functional changes here: - The variable maxFramePushed_ now actually records the maximum value of masm.framePushed, not the maximum stack height. The new behavior is correct even with the chunky stack, since this value is used for stack overflow checking. There should however be no observable changes because of this. (Trivial reason: only ARM64 is affected and we have no ARM64 products. Deeper reason: stacks are aligned at coarser boundaries than our stack chunks, and have lots of headroom.) - Member variables tracking the stack height are now set up in a new method, onFixedStackAllocated(), which is called after beginFunction() has allocated the space for the Header and Local areas of the frame. The old behavior was correct but very obscure. The new code is easier to understand.

Bug 1507819 - Update to Cranelift 0.25. r=bbouvier

Bug 1507785 - Use logical, not physical, frame size at block exit. r=bbouvier Background: When we branch out of a block we must adjust the physical stack pointer along the edge so that it will be equal to the physical stack pointer as it is when we fall out of the block at the bottom. But along the edge we do not do anything to adjust the logical stack pointer, because the logical stack pointer is determined by the non-branching path through the code. But when we fall out of a block we must adjust both the physical and the logical stack pointers: the logical stack pointer may need to pop a few items to get to where it was on entry to the block (the stack can be higher because of pushes followed by an UNREACHABLE), and if the code is not dead we may also have to deallocate some stack memory by changing the physical stack pointer. Previously, we used values for the physical stack pointers as guards on the block-exit code, but this is WRONG since it prevents us from doing something when the physical stack pointer does not change, as the case is on ARM64 when we do need to pop something logically but the stack stays within the currently allocated chunk - we would end up doing nothing when we should adjust the logical stack pointer. Instead, we should use the logical stack pointers for the guard, and then popChunkyBytes will take care of translating the difference in logical pointers for us so that a chunk is popped if that is required by the amount of deallocation. To catch these errors earlier we add an assertion on the logical stack frame size that is tested for every instruction we compile. The test case is reduced from the fuzzing test that found the bug.

Bug 1507944 - Baldr: ensure signal handlers in asm.js instantiation (r=bbouvier)

Bug 1506352 - Add a --log-wptreport option to jstests; r=bbouvier,jgraham