Attachment 370381 Details for Bug 198102 – Patch

[patch] Patch

bug-198102-20190521221136.patch (text/plain), 22.77 KB, created by Justin Michaud on 2019-05-21 22:11:36 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Justin Michaud

Created: 2019-05-21 22:11:36 PDT

Size: 22.77 KB

patch

obsolete

>Subversion Revision: 245613
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 1a77084e64e556f53a40130df0a827e0c22876bf..364cfb8c4aae319eeee26c2056f26953bb0ddc76 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,38 @@
>+2019-05-21  Justin Michaud  <justin_michaud@apple.com>
>+
>+        [WASM-References] Support Anyref in globals
>+        https://bugs.webkit.org/show_bug.cgi?id=198102
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Support anyref for globals, imports and exports. This adds code in B3 and Air to emit a write barrier
>+        on the JSWebAssemblyWrapper whenever an anyref global is set. This also fixes a small bug in emitCCall
>+        for air where it adds code to the wrong block.
>+
>+        * wasm/WasmAirIRGenerator.cpp:
>+        (JSC::Wasm::AirIRGenerator::emitCCall):
>+        (JSC::Wasm::AirIRGenerator::moveOpForValueType):
>+        (JSC::Wasm::AirIRGenerator::setGlobal):
>+        (JSC::Wasm::AirIRGenerator::emitWriteBarrierForJsWrapper):
>+        * wasm/WasmB3IRGenerator.cpp:
>+        (JSC::Wasm::B3IRGenerator::setGlobal):
>+        (JSC::Wasm::B3IRGenerator::emitWriteBarrierForJsWrapper):
>+        * wasm/WasmInstance.cpp:
>+        (JSC::Wasm::Instance::Instance):
>+        (JSC::Wasm::Instance::setGlobal):
>+        * wasm/WasmInstance.h:
>+        (JSC::Wasm::Instance::loadI32Global const):
>+        (JSC::Wasm::Instance::loadI64Global const):
>+        (JSC::Wasm::Instance::setGlobal):
>+        (JSC::Wasm::Instance::shouldMarkGlobal):
>+        (JSC::Wasm::Instance::numGlobals const):
>+        * wasm/WasmSectionParser.cpp:
>+        (JSC::Wasm::SectionParser::parseInitExpr):
>+        * wasm/js/JSWebAssemblyInstance.cpp:
>+        (JSC::JSWebAssemblyInstance::visitChildren):
>+        * wasm/js/WebAssemblyModuleRecord.cpp:
>+        (JSC::WebAssemblyModuleRecord::link):
>+
> 2019-05-21  Ross Kirsling  <ross.kirsling@sony.com>
> 
>         [PlayStation] Don't call fcntl.
>diff --git a/Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp b/Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp
>index f7960731806ab7c6939f753075b7062c43cf68cf..d48cca68ea7481e2624774ee05a3e9ab5ee23a61 100644
>--- a/Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp
>+++ b/Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp
>@@ -42,6 +42,7 @@
> #include "BinarySwitch.h"
> #include "DisallowMacroScratchRegisterUsage.h"
> #include "JSCInlines.h"
>+#include "JSWebAssemblyInstance.h"
> #include "ScratchRegisterAllocator.h"
> #include "VirtualRegister.h"
> #include "WasmCallingConvention.h"
>@@ -529,7 +530,7 @@ private:
>         Inst inst(CCall, origin);
> 
>         Tmp callee = g64();
>-        append(Move, Arg::immPtr(tagCFunctionPtr<void*>(func, B3CCallPtrTag)), callee);
>+        append(block, Move, Arg::immPtr(tagCFunctionPtr<void*>(func, B3CCallPtrTag)), callee);
>         inst.args.append(callee);
> 
>         if (result)
>@@ -547,6 +548,7 @@ private:
>         case Type::I32:
>             return Move32;
>         case Type::I64:
>+        case Type::Anyref:
>             return Move;
>         case Type::F32:
>             return MoveFloat;
>@@ -561,6 +563,7 @@ private:
> 
>     void emitTierUpCheck(uint32_t decrementCount, B3::Origin);
> 
>+    void emitWriteBarrierForJsWrapper();
>     ExpressionType emitCheckAndPreparePointer(ExpressionType pointer, uint32_t offset, uint32_t sizeOfOp);
>     ExpressionType emitLoadOp(LoadOpType, ExpressionType pointer, uint32_t offset);
>     void emitStoreOp(StoreOpType, ExpressionType pointer, ExpressionType value, uint32_t offset);
>@@ -1059,9 +1062,36 @@ auto AirIRGenerator::setGlobal(uint32_t index, ExpressionType value) -> PartialR
>         append(moveOpForValueType(type), value, Arg::addr(temp));
>     }
> 
>+    if (type == Anyref)
>+        emitWriteBarrierForJsWrapper();
>+
>     return { };
> }
> 
>+inline void AirIRGenerator::emitWriteBarrierForJsWrapper()
>+{
>+    auto cell = g64();
>+
>+    append(Move, Arg::bigImm(Instance::offsetOfOwner()), cell);
>+    append(Add64, instanceValue(), cell);
>+    append(Move, Arg::addr(cell), cell);
>+
>+    BasicBlock* slowPath = m_code.addBlock();
>+    BasicBlock* continuation = m_code.addBlock();
>+
>+    append(Branch8, Arg::relCond(MacroAssembler::Above), Arg::addr(cell, JSCell::cellStateOffset()), Arg::imm(blackThreshold));
>+    m_currentBlock->setSuccessors(continuation, slowPath);
>+
>+    void (*writeBarrier)(JSWebAssemblyInstance*) = [] (JSWebAssemblyInstance* cell) -> void {
>+        cell->vm()->heap.writeBarrierSlowPath(cell);
>+    };
>+    emitCCall(slowPath, writeBarrier, TypedTmp(), cell);
>+    append(slowPath, Jump);
>+    slowPath->setSuccessors(continuation);
>+
>+    m_currentBlock = continuation;
>+}
>+
> inline AirIRGenerator::ExpressionType AirIRGenerator::emitCheckAndPreparePointer(ExpressionType pointer, uint32_t offset, uint32_t sizeOfOperation)
> {
>     ASSERT(m_memoryBaseGPR);
>diff --git a/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp b/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp
>index bb2471f8da7603808b564203f0078ba3c6681f7c..fd2c32588d4b7540a6293643602d4cbfdff461bb 100644
>--- a/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp
>+++ b/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp
>@@ -49,6 +49,7 @@
> #include "B3WasmBoundsCheckValue.h"
> #include "DisallowMacroScratchRegisterUsage.h"
> #include "JSCInlines.h"
>+#include "JSWebAssemblyInstance.h"
> #include "ScratchRegisterAllocator.h"
> #include "VirtualRegister.h"
> #include "WasmCallingConvention.h"
>@@ -239,6 +240,7 @@ private:
> 
>     void emitTierUpCheck(uint32_t decrementCount, Origin);
> 
>+    void emitWriteBarrierForJsWrapper();
>     ExpressionType emitCheckAndPreparePointer(ExpressionType pointer, uint32_t offset, uint32_t sizeOfOp);
>     B3::Kind memoryKind(B3::Opcode memoryOp);
>     ExpressionType emitLoadOp(LoadOpType, ExpressionType pointer, uint32_t offset);
>@@ -641,9 +643,39 @@ auto B3IRGenerator::setGlobal(uint32_t index, ExpressionType value) -> PartialRe
>     ASSERT(toB3Type(m_info.globals[index].type) == value->type());
>     Value* globalsArray = m_currentBlock->appendNew<MemoryValue>(m_proc, Load, pointerType(), origin(), instanceValue(), safeCast<int32_t>(Instance::offsetOfGlobals()));
>     m_currentBlock->appendNew<MemoryValue>(m_proc, Store, origin(), value, globalsArray, safeCast<int32_t>(index * sizeof(Register)));
>+
>+    if (m_info.globals[index].type == Anyref)
>+        emitWriteBarrierForJsWrapper();
>+
>     return { };
> }
> 
>+inline void B3IRGenerator::emitWriteBarrierForJsWrapper()
>+{
>+    Value* cell = m_currentBlock->appendNew<MemoryValue>(m_proc, Load, pointerType(), origin(), instanceValue(), safeCast<int32_t>(Instance::offsetOfOwner()));
>+
>+    BasicBlock* slowPath = m_proc.addBlock();
>+    BasicBlock* continuation = m_proc.addBlock();
>+
>+    Value* cellState = m_currentBlock->appendNew<MemoryValue>(m_proc, Load8Z, Int32, origin(), cell, safeCast<int32_t>(JSCell::cellStateOffset()));
>+    Value* isSlowPath = m_currentBlock->appendNew<Value>(m_proc, Above, origin(), cellState, m_currentBlock->appendNew<Const32Value>(m_proc, origin(), blackThreshold));
>+
>+    m_currentBlock->appendNewControlValue(m_proc, B3::Branch, origin(), isSlowPath, FrequentedBlock(continuation), FrequentedBlock(slowPath, FrequencyClass::Rare));
>+    void (*writeBarrier)(JSWebAssemblyInstance*) = [] (JSWebAssemblyInstance* cell) -> void {
>+        cell->vm()->heap.writeBarrierSlowPath(cell);
>+    };
>+
>+    Value* writeBarrierAddress = slowPath->appendNew<ConstPtrValue>(m_proc, origin(), tagCFunctionPtr<void*>(writeBarrier, B3CCallPtrTag));
>+    slowPath->appendNew<CCallValue>(m_proc, B3::Void, origin(), writeBarrierAddress, cell);
>+    slowPath->appendNewControlValue(m_proc, Jump, origin(), continuation);
>+
>+    slowPath->addPredecessor(m_currentBlock);
>+    continuation->addPredecessor(m_currentBlock);
>+    continuation->addPredecessor(slowPath);
>+
>+    m_currentBlock = continuation;
>+}
>+
> inline Value* B3IRGenerator::emitCheckAndPreparePointer(ExpressionType pointer, uint32_t offset, uint32_t sizeOfOperation)
> {
>     ASSERT(m_memoryBaseGPR);
>diff --git a/Source/JavaScriptCore/wasm/WasmInstance.cpp b/Source/JavaScriptCore/wasm/WasmInstance.cpp
>index dcbaa357e63a2beb9594f635a6805495c6306983..e05f66de07def2d1f3b68f8d0dcf819ba3d7be6e 100644
>--- a/Source/JavaScriptCore/wasm/WasmInstance.cpp
>+++ b/Source/JavaScriptCore/wasm/WasmInstance.cpp
>@@ -28,6 +28,8 @@
> 
> #if ENABLE(WEBASSEMBLY)
> 
>+#include "JSCInlines.h"
>+#include "JSWebAssemblyInstance.h"
> #include "Register.h"
> #include "WasmModuleInformation.h"
> #include <wtf/CheckedArithmetic.h>
>@@ -44,14 +46,18 @@ size_t globalMemoryByteSize(Module& module)
> Instance::Instance(Context* context, Ref<Module>&& module, EntryFrame** pointerToTopEntryFrame, void** pointerToActualStackLimit, StoreTopCallFrameCallback&& storeTopCallFrame)
>     : m_context(context)
>     , m_module(WTFMove(module))
>-    , m_globals(MallocPtr<uint64_t>::malloc(globalMemoryByteSize(m_module.get())))
>+    , m_globals(MallocPtr<GlobalValue>::malloc(globalMemoryByteSize(m_module.get())))
>+    , m_globalsShouldMark(MallocPtr<bool>::malloc(m_module.get().moduleInformation().globals.size()))
>     , m_pointerToTopEntryFrame(pointerToTopEntryFrame)
>     , m_pointerToActualStackLimit(pointerToActualStackLimit)
>     , m_storeTopCallFrame(WTFMove(storeTopCallFrame))
>     , m_numImportFunctions(m_module->moduleInformation().importFunctionCount())
>+    , m_numGlobals(m_module->moduleInformation().globals.size())
> {
>     for (unsigned i = 0; i < m_numImportFunctions; ++i)
>         new (importFunctionInfo(i)) ImportFunctionInfo();
>+    for (unsigned i = 0; i < m_numGlobals; ++i)
>+        m_globalsShouldMark.get()[i] = m_module.get().moduleInformation().globals[i].type == Anyref;
> }
> 
> Ref<Instance> Instance::create(Context* context, Ref<Module>&& module, EntryFrame** pointerToTopEntryFrame, void** pointerToActualStackLimit, StoreTopCallFrameCallback&& storeTopCallFrame)
>@@ -66,6 +72,12 @@ size_t Instance::extraMemoryAllocated() const
>     return globalMemoryByteSize(m_module.get()) + allocationSize(m_numImportFunctions);
> }
> 
>+void Instance::setGlobal(unsigned i, JSValue bits)
>+{
>+    ASSERT(m_owner);
>+    m_globals.get()[i].anyref.set(*owner<JSWebAssemblyInstance>()->vm(), owner<JSWebAssemblyInstance>(), bits);
>+}
>+
> } } // namespace JSC::Wasm
> 
> #endif // ENABLE(WEBASSEMBLY)
>diff --git a/Source/JavaScriptCore/wasm/WasmInstance.h b/Source/JavaScriptCore/wasm/WasmInstance.h
>index cd34a648dd52fcdbe2474e68b2b7c687277f40e0..84f5786edbd5f7e42b13771c80a73f478bd29e5b 100644
>--- a/Source/JavaScriptCore/wasm/WasmInstance.h
>+++ b/Source/JavaScriptCore/wasm/WasmInstance.h
>@@ -31,6 +31,7 @@
> #include "WasmMemory.h"
> #include "WasmModule.h"
> #include "WasmTable.h"
>+#include "WriteBarrier.h"
> #include <wtf/RefPtr.h>
> #include <wtf/ThreadSafeRefCounted.h>
> 
>@@ -82,11 +83,13 @@ public:
>     }
>     void setTable(Ref<Table>&& table) { m_table = WTFMove(table); }
> 
>-    int32_t loadI32Global(unsigned i) const { return m_globals.get()[i]; }
>-    int64_t loadI64Global(unsigned i) const { return m_globals.get()[i]; }
>+    int32_t loadI32Global(unsigned i) const { return m_globals.get()[i].primitive; }
>+    int64_t loadI64Global(unsigned i) const { return m_globals.get()[i].primitive; }
>     float loadF32Global(unsigned i) const { return bitwise_cast<float>(loadI32Global(i)); }
>     double loadF64Global(unsigned i) const { return bitwise_cast<double>(loadI64Global(i)); }
>-    void setGlobal(unsigned i, int64_t bits) { m_globals.get()[i] = bits; }
>+    void setGlobal(unsigned i, int64_t bits) { m_globals.get()[i].primitive = bits; }
>+    void setGlobal(unsigned, JSValue);
>+    bool shouldMarkGlobal(unsigned i) { return m_globalsShouldMark.get()[i]; }
> 
>     static ptrdiff_t offsetOfMemory() { return OBJECT_OFFSETOF(Instance, m_memory); }
>     static ptrdiff_t offsetOfGlobals() { return OBJECT_OFFSETOF(Instance, m_globals); }
>@@ -118,6 +121,7 @@ public:
>         void* importFunction { nullptr }; // In a JS embedding, this is a WriteBarrier<JSObject>.
>     };
>     unsigned numImportFunctions() const { return m_numImportFunctions; }
>+    unsigned numGlobals() const { return m_numGlobals; }
>     ImportFunctionInfo* importFunctionInfo(size_t importFunctionNum)
>     {
>         RELEASE_ASSERT(importFunctionNum < m_numImportFunctions);
>@@ -149,12 +153,19 @@ private:
>     RefPtr<CodeBlock> m_codeBlock;
>     RefPtr<Memory> m_memory;
>     RefPtr<Table> m_table;
>-    MallocPtr<uint64_t> m_globals;
>+
>+    union GlobalValue {
>+        WriteBarrier<Unknown> anyref;
>+        uint64_t primitive;
>+    };
>+    MallocPtr<GlobalValue> m_globals;
>+    MallocPtr<bool> m_globalsShouldMark;
>     EntryFrame** m_pointerToTopEntryFrame { nullptr };
>     void** m_pointerToActualStackLimit { nullptr };
>     void* m_cachedStackLimit { bitwise_cast<void*>(std::numeric_limits<uintptr_t>::max()) };
>     StoreTopCallFrameCallback m_storeTopCallFrame;
>     unsigned m_numImportFunctions { 0 };
>+    unsigned m_numGlobals { 0 };
> };
> 
> } } // namespace JSC::Wasm
>diff --git a/Source/JavaScriptCore/wasm/WasmSectionParser.cpp b/Source/JavaScriptCore/wasm/WasmSectionParser.cpp
>index b85ccea426631bc3c167137744863c93a7b7e778..6b940f7364e434d3f33dfda819a97c6f94b0731d 100644
>--- a/Source/JavaScriptCore/wasm/WasmSectionParser.cpp
>+++ b/Source/JavaScriptCore/wasm/WasmSectionParser.cpp
>@@ -476,6 +476,12 @@ auto SectionParser::parseInitExpr(uint8_t& opcode, uint64_t& bitsOrImportNumber,
>         break;
>     }
> 
>+    case RefNull: {
>+        resultType = Anyref;
>+        bitsOrImportNumber = JSValue::encode(jsNull());
>+        break;
>+    }
>+
>     default:
>         WASM_PARSER_FAIL_IF(true, "unknown init_expr opcode ", opcode);
>     }
>diff --git a/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp b/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp
>index a63cff2fb1878036f1857fd57cbd84a4bdc44f7e..6e485329a886c95e87134131967aaed3e0cdd353 100644
>--- a/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp
>+++ b/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp
>@@ -89,6 +89,12 @@ void JSWebAssemblyInstance::visitChildren(JSCell* cell, SlotVisitor& visitor)
>     visitor.reportExtraMemoryVisited(thisObject->m_instance->extraMemoryAllocated());
>     for (unsigned i = 0; i < thisObject->instance().numImportFunctions(); ++i)
>         visitor.append(*thisObject->instance().importFunction<WriteBarrier<JSObject>>(i)); // This also keeps the functions' JSWebAssemblyInstance alive.
>+
>+    for (unsigned i = 0; i < thisObject->instance().numGlobals(); ++i) {
>+        // FIXME: We need to box wasm Funcrefs once they are supported here.
>+        if (thisObject->instance().shouldMarkGlobal(i))
>+            visitor.appendUnbarriered(JSValue::decode(thisObject->instance().loadI64Global(i)));
>+    }
> }
> 
> void JSWebAssemblyInstance::finalizeCreation(VM& vm, ExecState* exec, Ref<Wasm::CodeBlock>&& wasmCodeBlock, JSObject* importObject, Wasm::CreationMode creationMode)
>diff --git a/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp b/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp
>index 3765552c1b5aa2f7bc70e743f84f03367bb12e63..d7d02139b85735573f2c8003e93c99ba9e8280d2 100644
>--- a/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp
>+++ b/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp
>@@ -235,10 +235,13 @@ void WebAssemblyModuleRecord::link(ExecState* exec, JSValue, JSObject* importObj
>             // ii. If the global_type of i is i64 or Type(v) is not Number, throw a WebAssembly.LinkError.
>             if (moduleInformation.globals[import.kindIndex].type == Wasm::I64)
>                 return exception(createJSWebAssemblyLinkError(exec, vm, importFailMessage(import, "imported global", "cannot be an i64")));
>-            if (!value.isNumber())
>+            if (moduleInformation.globals[import.kindIndex].type != Wasm::Anyref && !value.isNumber())
>                 return exception(createJSWebAssemblyLinkError(exec, vm, importFailMessage(import, "imported global", "must be a number")));
>             // iii. Append ToWebAssemblyValue(v) to imports.
>             switch (moduleInformation.globals[import.kindIndex].type) {
>+            case Wasm::Anyref:
>+                m_instance->instance().setGlobal(import.kindIndex, value);
>+                break;
>             case Wasm::I32:
>                 m_instance->instance().setGlobal(import.kindIndex, value.toInt32(exec));
>                 break;
>@@ -379,6 +382,11 @@ void WebAssemblyModuleRecord::link(ExecState* exec, JSValue, JSObject* importObj
>             ASSERT(global.mutability == Wasm::Global::Immutable);
>             // Return ToJSValue(v).
>             switch (global.type) {
>+            case Wasm::Anyref:
>+                // FIXME: We need to box wasm Funcrefs once they are supported here.
>+                exportedValue = JSValue::decode(m_instance->instance().loadI64Global(exp.kindIndex));
>+                break;
>+
>             case Wasm::I32:
>                 exportedValue = JSValue(m_instance->instance().loadI32Global(exp.kindIndex));
>                 break;
>diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
>index 4e4f88656ac84a3bc0bf726ebf35439d91e305ad..2c216654700898b687dadcf42d925d945096d19a 100644
>--- a/JSTests/ChangeLog
>+++ b/JSTests/ChangeLog
>@@ -1,3 +1,22 @@
>+2019-05-21  Justin Michaud  <justin_michaud@apple.com>
>+
>+        [WASM-References] Support Anyref in globals
>+        https://bugs.webkit.org/show_bug.cgi?id=198102
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Add test for anyrefs in globals, as well as adding a new RefNull initExpr for Builder.
>+
>+        * wasm/Builder.js:
>+        (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
>+        * wasm/Builder_WebAssemblyBinary.js:
>+        (const.putInitExpr):
>+        * wasm/references/anyref_globals.js: Added.
>+        (GetGlobal.0.End.End.WebAssembly):
>+        (5.doGCSet):
>+        (doGCTest):
>+        (doGCSet.doGCTest.let.count.0.doBarrierSet):
>+
> 2019-05-20  Keith Miller  <keith_miller@apple.com>
> 
>         Cleanup Yarr regexp code around paren contexts.
>diff --git a/JSTests/wasm/Builder.js b/JSTests/wasm/Builder.js
>index f22de1b81c8409da044bb05112a45cd29fd72896..7e7c1b7dc223c883e10e6f373bcdd3c6c29d511b 100644
>--- a/JSTests/wasm/Builder.js
>+++ b/JSTests/wasm/Builder.js
>@@ -535,6 +535,10 @@ export default class Builder {
>                         GetGlobal: (type, initValue, mutability) => {
>                             s.data.push({ type, op: "get_global", mutability: _normalizeMutability(mutability), initValue });
>                             return _errorHandlingProxyFor(globalBuilder);
>+                        },
>+                        RefNull: (type, mutability) => {
>+                            s.data.push({ type, op: "ref.null", mutability: _normalizeMutability(mutability) });
>+                            return _errorHandlingProxyFor(globalBuilder);
>                         }
>                     };
>                     for (let op of WASM.description.value_type) {
>diff --git a/JSTests/wasm/Builder_WebAssemblyBinary.js b/JSTests/wasm/Builder_WebAssemblyBinary.js
>index e949835d848c7539582dd801e564c3f88389c155..ca8fd8f65f696f9b509810c1c602ca4a7ad4c6e4 100644
>--- a/JSTests/wasm/Builder_WebAssemblyBinary.js
>+++ b/JSTests/wasm/Builder_WebAssemblyBinary.js
>@@ -90,7 +90,10 @@ const putOp = (bin, op) => {
> };
> 
> const putInitExpr = (bin, expr) => {
>-    putOp(bin, { value: WASM.description.opcode[expr.op].value, name: expr.op, immediates: [expr.initValue], arguments: [] });
>+    if (expr.op == "ref.null")
>+        putOp(bin, { value: WASM.description.opcode[expr.op].value, name: expr.op, immediates: [], arguments: [] });
>+    else
>+        putOp(bin, { value: WASM.description.opcode[expr.op].value, name: expr.op, immediates: [expr.initValue], arguments: [] });
>     putOp(bin, { value: WASM.description.opcode.end.value, name: "end", immediates: [], arguments: [] });
> };
> 
>diff --git a/JSTests/wasm/references/anyref_globals.js b/JSTests/wasm/references/anyref_globals.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..dff79313b79e28a4cccde2db15fe4db306d0672c
>--- /dev/null
>+++ b/JSTests/wasm/references/anyref_globals.js
>@@ -0,0 +1,112 @@
>+import * as assert from '../assert.js';
>+import Builder from '../Builder.js';
>+
>+fullGC()
>+gc()
>+
>+const $1 = new WebAssembly.Instance(new WebAssembly.Module((new Builder())
>+      .Type().End()
>+      .Import()
>+           .Global().Anyref("imp", "ref", "immutable").End()
>+      .End()
>+      .Function().End()
>+      .Global()
>+          .RefNull("anyref", "mutable")
>+          .RefNull("anyref", "immutable")
>+          .GetGlobal("anyref", 0, "mutable")
>+      .End()
>+      .Export()
>+          .Function("set_glob")
>+          .Function("get_glob")
>+          .Function("glob_is_null")
>+          .Function("set_glob_null")
>+          .Function("get_import")
>+          .Global("expglob", 2)
>+          .Global("expglob2", 0)
>+      .End()
>+      .Code()
>+        .Function("set_glob", { params: ["anyref"], ret: "void" })
>+          .GetLocal(0)
>+          .SetGlobal(1)
>+        .End()
>+
>+        .Function("get_glob", { params: [], ret: "anyref" })
>+            .GetGlobal(1)
>+        .End()
>+
>+        .Function("glob_is_null", { params: [], ret: "i32" })
>+            .Call(1)
>+            .RefIsNull()
>+        .End()
>+
>+        .Function("set_glob_null", { params: [], ret: "void" })
>+            .RefNull()
>+            .Call(0)
>+        .End()
>+
>+        .Function("get_import", { params: [], ret: "anyref" })
>+            .GetGlobal(0)
>+        .End()
>+      .End().WebAssembly().get()), { imp: { ref: "hi" } });
>+
>+assert.eq($1.exports.get_import(), "hi")
>+assert.eq($1.exports.expglob, null)
>+assert.eq($1.exports.expglob2, "hi")
>+assert.eq($1.exports.get_glob(), null)
>+
>+const obj = { test: "hi" }
>+
>+$1.exports.set_glob(obj); assert.eq($1.exports.get_glob(), obj);
>+$1.exports.set_glob(5); assert.eq($1.exports.get_glob(), 5)
>+$1.exports.set_glob(null); assert.eq($1.exports.get_glob(), null)
>+$1.exports.set_glob("hi"); assert.eq($1.exports.get_glob(), "hi")
>+$1.exports.set_glob(undefined); assert.eq($1.exports.get_glob(), undefined)
>+assert.eq($1.exports.glob_is_null(), 0)
>+$1.exports.set_glob_null(); assert.eq($1.exports.get_glob(), null)
>+assert.eq($1.exports.glob_is_null(), 1)
>+
>+const obj2 = { test: 21 }
>+$1.exports.set_glob(obj2); assert.eq($1.exports.get_glob(), obj2)
>+
>+$1.exports.get_glob(obj2).test = 5;
>+assert.eq($1.exports.get_glob().test, 5)
>+assert.eq(obj2.test, 5)
>+
>+function doGCSet() {
>+    fullGC()
>+    $1.exports.set_glob({ test: -1 })
>+    fullGC()
>+}
>+
>+function doGCTest() {
>+    for (let i=0; i<1000; ++i) {
>+        assert.eq($1.exports.get_glob().test, -1)
>+        fullGC()
>+    }
>+}
>+
>+doGCSet()
>+doGCTest()
>+
>+let count = 0
>+
>+function doBarrierSet() {
>+    ++count
>+    $1.exports.set_glob({ test: -count })
>+}
>+
>+function doBarrierTest() {
>+    let garbage = { val: "hi", val2: 5, arr: [] }
>+    for (let i=0; i<100; ++i) garbage.arr += ({ field: i })
>+
>+    for (let j=0; j<1000; ++j) {
>+        assert.eq($1.exports.get_glob().test, -count)
>+        edenGC()
>+    }
>+}
>+
>+for (let i=0; i<2; ++i) {
>+    doBarrierSet()
>+    doBarrierTest()
>+    doBarrierTest()
>+}

Actions: View | Formatted Diff | Diff

Attachments on bug 198102: 370381 | 370485 | 370525 | 370552 | 370562 | 370584 | 370611