[webkit-changes] [WebKit/WebKit] b8f9d4: [Wasm-GC] Add support for final attribute

[Asumu Takikawa]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: b8f9d496f05d9cf92f752a5ffb208d015a26a794
      https://github.com/WebKit/WebKit/commit/b8f9d496f05d9cf92f752a5ffb208d015a26a794
  Author: Asumu Takikawa <asumu at igalia.com>
  Date:   2023-08-14 (Mon, 14 Aug 2023)

  Changed paths:
    M JSTests/wasm/gc-spec-tests/ref_cast.wast.js
    M JSTests/wasm/gc-spec-tests/type-subtyping.wast.js
    M JSTests/wasm/gc/arrays.js
    M JSTests/wasm/gc/bug247874.js
    M JSTests/wasm/gc/casts.js
    M JSTests/wasm/gc/structs.js
    M JSTests/wasm/gc/sub.js
    M JSTests/wasm/wasm.json
    M Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
    M Source/JavaScriptCore/wasm/WasmCallingConvention.h
    M Source/JavaScriptCore/wasm/WasmFormat.h
    M Source/JavaScriptCore/wasm/WasmFunctionParser.h
    M Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp
    M Source/JavaScriptCore/wasm/WasmSectionParser.cpp
    M Source/JavaScriptCore/wasm/WasmSectionParser.h
    M Source/JavaScriptCore/wasm/WasmTypeDefinition.cpp
    M Source/JavaScriptCore/wasm/WasmTypeDefinition.h
    M Source/JavaScriptCore/wasm/js/JSWebAssemblyStruct.cpp
    M Source/JavaScriptCore/wasm/js/WasmToJS.cpp
    M Source/JavaScriptCore/wasm/wasm.json

  Log Message:
  -----------
  [Wasm-GC] Add support for final attribute
https://bugs.webkit.org/show_bug.cgi?id=250107

Reviewed by Justin Michaud.

Adds support for `final` attribute on `sub` types. This enables types to be
marked final, in which case they cannot be inherited from. This changes the
default for shorthands like `struct` to be final.

As a result, the representation of subtypes needs to change to allow 0 or 1
supertypes (previously, 0 supertype subs were normalized to not using a Subtype
constructor). To accommodate this, the representation is changed to allow
an arbitrary number of supertypes (though restricted to 0 or 1 in practice).

This patch also fixes some additional bugs found in related code, such as a
missing subtype check for certain kinds of `rec` types and fixing a case where
type indices were resolved too early in array operation validation.

In addition to tests for final attributes, this patch updates tests where the a
new `sub` is needed due to changes in default finality. It also updates GC spec
tests where needed to the version in commit
c7de5a1c1e261808a0c7744177589f6eb25da145 of the GC proposal repo.

* JSTests/wasm/gc-spec-tests/ref_cast.wast.js:
* JSTests/wasm/gc-spec-tests/type-subtyping.wast.js:
* JSTests/wasm/gc/arrays.js:
(testArrayNewDefault):
(testArrayGet):
* JSTests/wasm/gc/bug247874.js:
(i.instantiate.module.type.struct.type.sub.0.struct.field.i32.global.import.string_appeared_here.string_appeared_here): Deleted.
* JSTests/wasm/gc/casts.js:
(testSubtypeCasts):
* JSTests/wasm/gc/structs.js:
(testStructNewDefault):
* JSTests/wasm/gc/sub.js:
(testSubDeclaration):
* JSTests/wasm/wasm.json:
* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:
(JSC::Wasm::BBQJIT::sizeOfType):
(JSC::Wasm::BBQJIT::toValueKind):
(JSC::Wasm::BBQJIT::getGlobal):
(JSC::Wasm::BBQJIT::setGlobal):
(JSC::Wasm::BBQJIT::addTopLevel):
(JSC::Wasm::BBQJIT::emitCatchImpl):
(JSC::Wasm::BBQJIT::emitCCall):
* Source/JavaScriptCore/wasm/WasmCallingConvention.h:
(JSC::Wasm::WasmCallingConvention::numberOfStackResults const):
(JSC::Wasm::WasmCallingConvention::numberOfStackArguments const):
* Source/JavaScriptCore/wasm/WasmFormat.h:
(JSC::Wasm::arrayrefType):
* Source/JavaScriptCore/wasm/WasmFunctionParser.h:
(JSC::Wasm::FunctionParser<Context>::parseArrayTypeDefinition):
* Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp:
(JSC::Wasm::LLIntGenerator::callInformationForCaller):
(JSC::Wasm::LLIntGenerator::callInformationForCallee):
(JSC::Wasm::LLIntGenerator::addArguments):
* Source/JavaScriptCore/wasm/WasmSectionParser.cpp:
(JSC::Wasm::SectionParser::parseType):
(JSC::Wasm::SectionParser::parseRecursionGroup):
(JSC::Wasm::SectionParser::checkSubtypeValidity):
(JSC::Wasm::SectionParser::parseSubtype):
* Source/JavaScriptCore/wasm/WasmSectionParser.h:
* Source/JavaScriptCore/wasm/WasmTypeDefinition.cpp:
(JSC::Wasm::Subtype::dump const):
(JSC::Wasm::Subtype::cleanup):
(JSC::Wasm::computeSubtypeHash):
(JSC::Wasm::TypeDefinition::hash const):
(JSC::Wasm::TypeDefinition::tryCreateSubtype):
(JSC::Wasm::TypeDefinition::replacePlaceholders const):
(JSC::Wasm::TypeDefinition::hasRecursiveReference const):
(JSC::Wasm::TypeInformation::signatureForLLIntBuiltin):
(JSC::Wasm::SubtypeParameterTypes::hash):
(JSC::Wasm::SubtypeParameterTypes::equal):
(JSC::Wasm::SubtypeParameterTypes::translate):
(JSC::Wasm::TypeInformation::TypeInformation):
(JSC::Wasm::TypeInformation::typeDefinitionForSubtype):
(JSC::Wasm::TypeInformation::canonicalRTTForType):
* Source/JavaScriptCore/wasm/WasmTypeDefinition.h:
(JSC::Wasm::typeKindSizeInBytes):
(JSC::Wasm::Subtype::Subtype):
(JSC::Wasm::Subtype::supertypeCount const):
(JSC::Wasm::Subtype::isFinal const):
(JSC::Wasm::Subtype::firstSuperType const):
(JSC::Wasm::Subtype::superType const):
(JSC::Wasm::Subtype::getSuperType):
(JSC::Wasm::TypeDefinition::TypeDefinition):
* Source/JavaScriptCore/wasm/js/JSWebAssemblyStruct.cpp:
(JSC::JSWebAssemblyStruct::set):
* Source/JavaScriptCore/wasm/js/WasmToJS.cpp:
(JSC::Wasm::wasmToJS):
* Source/JavaScriptCore/wasm/wasm.json:

Canonical link: https://commits.webkit.org/266890@main