[Webkit-unassigned] [Bug 252722] New: [Wasm-GC] wasm-b3 test config in run-jsc-stress-tests script doesn't run B3

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=252722

            Bug ID: 252722
           Summary: [Wasm-GC] wasm-b3 test config in run-jsc-stress-tests
                    script doesn't run B3
           Product: WebKit
           Version: WebKit Local Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebAssembly
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: tjc at igalia.com

I noticed while isolating bug 252719 that the run-jsc-stress-tests script doesn't cause B3 to be invoked when running the "wasm-b3" config. "wasm-b3" amounts to the following command-line options:

```
--useFTLJIT\=false --useFunctionDotArguments\=true --validateExceptionChecks\=true --useDollarVM\=true --maxPerThreadStackUsage\=1572864 --useWasmLLInt\=false --wasmBBQUsesAir\=false --useFTLJIT\=true
```

The `BBQPlan::planGeneratesLoopOSREntrypoints()` method ( https://searchfox.org/wubkat/source/Source/JavaScriptCore/wasm/WasmBBQPlan.cpp#64 ) returns true unless either the `--webAssemblyBBQAirModeThreshold` option or the `--useSinglePassBBQJIT` option is present. `BBQPlan::compileFunction()` ( https://searchfox.org/wubkat/source/Source/JavaScriptCore/wasm/WasmBBQPlan.cpp#276 ) only invokes B3 if that method returns false. So when running tests with the wasm-b3 config, B3 is never invoked, which seems like it's unintentional.

I verified this by editing WasmB3IRGenerator to replace all the generated code for array and struct operations with `addCrash()` calls and running `run-jsc-stress-tests --filter wasm/gc`. All the tests still passed, suggesting that B3 code isn't being compiled/run with any of the combinations of options that run-jsc-stress-tests uses.

I was able to force B3 to be invoked by adding `--webAssemblyBBQAirModeThreshold=1` to the options for wasm-b3 in the run-jsc-stress-tests script, but I don't know if that's the right solution.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20230222/467ba096/attachment.htm>