[webkit-changes] [WebKit/WebKit] 92e8b1: [Wasm-GC] Implement br_on_cast and br_on_cast_fail

[Asumu Takikawa]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 92e8b1300f34bcb5dcc7c17ebb1b8c49a39633d2
      https://github.com/WebKit/WebKit/commit/92e8b1300f34bcb5dcc7c17ebb1b8c49a39633d2
  Author: Asumu Takikawa <asumu at igalia.com>
  Date:   2023-12-09 (Sat, 09 Dec 2023)

  Changed paths:
    A JSTests/wasm/gc-spec-tests/br_on_cast.wast.js
    A JSTests/wasm/gc-spec-tests/br_on_cast_fail.wast.js
    A JSTests/wasm/gc/br_on_cast.js
    M JSTests/wasm/wasm.json
    M Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp
    M Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
    M Source/JavaScriptCore/wasm/WasmConstExprGenerator.cpp
    M Source/JavaScriptCore/wasm/WasmFunctionParser.h
    M Source/JavaScriptCore/wasm/WasmIPIntGenerator.cpp
    M Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp
    M Source/JavaScriptCore/wasm/WasmOperations.cpp
    M Source/JavaScriptCore/wasm/WasmOperations.h
    M Source/JavaScriptCore/wasm/WasmSlowPaths.cpp
    M Source/JavaScriptCore/wasm/WasmTypeDefinition.cpp
    M Source/JavaScriptCore/wasm/WasmTypeDefinition.h
    M Source/JavaScriptCore/wasm/wasm.json

  Log Message:
  -----------
  [Wasm-GC] Implement br_on_cast and br_on_cast_fail
https://bugs.webkit.org/show_bug.cgi?id=254694

Reviewed by Justin Michaud.

Implements the br_on_cast and br_on_cast_fail instructions. These instructions
are compiled via a new addBranchCast method in the Wasm generators.

To accommodate the fail case, the emit functions and operations for RefTest are
given flags whether to negate the operation.

This patch also fixes some missing subtype checks for block parameters.

* JSTests/wasm/gc-spec-tests/br_on_cast.wast.js: Added.
* JSTests/wasm/gc-spec-tests/br_on_cast_fail.wast.js: Added.
* JSTests/wasm/gc/br_on_cast.js: Added.
(testBrOnCastValidation):
* JSTests/wasm/wasm.json:
* Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp:
(JSC::Wasm::B3IRGenerator::addRefTest):
(JSC::Wasm::B3IRGenerator::addRefCast):
(JSC::Wasm::B3IRGenerator::emitRefTestOrCast):
(JSC::Wasm::B3IRGenerator::addBranchCast):
* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:
(JSC::Wasm::BBQJIT::addRefTest):
(JSC::Wasm::BBQJIT::addBranchNull):
(JSC::Wasm::BBQJIT::addBranchCast):
* Source/JavaScriptCore/wasm/WasmConstExprGenerator.cpp:
* Source/JavaScriptCore/wasm/WasmFunctionParser.h:
(JSC::Wasm::FunctionParser<Context>::parseExpression):
* Source/JavaScriptCore/wasm/WasmIPIntGenerator.cpp:
(JSC::Wasm::IPIntGenerator::addRefTest):
(JSC::Wasm::IPIntGenerator::addBranchCast):
* Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp:
(JSC::Wasm::LLIntGenerator::addBranchCast):
(JSC::Wasm::LLIntGenerator::addRefTest):
* Source/JavaScriptCore/wasm/WasmOperations.cpp:
(JSC::Wasm::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/wasm/WasmOperations.h:
* Source/JavaScriptCore/wasm/WasmSlowPaths.cpp:
(JSC::LLInt::WASM_SLOW_PATH_DECL):
* Source/JavaScriptCore/wasm/WasmTypeDefinition.cpp:
(JSC::Wasm::TypeInformation::signatureForLLIntBuiltin):
(JSC::Wasm::TypeInformation::TypeInformation):
* Source/JavaScriptCore/wasm/WasmTypeDefinition.h:
* Source/JavaScriptCore/wasm/wasm.json:

Canonical link: https://commits.webkit.org/271810@main