[WIP] 2.46 BBQ backports - #1708
Open
justinmichaud wants to merge 17 commits into
Open
Conversation
justinmichaud
force-pushed
the
eng/wpe-246-bbq-fixes
branch
from
August 8, 2026 15:50
36db045 to
7fc6f31
Compare
https://bugs.webkit.org/show_bug.cgi?id=298157 Reviewed by Justin Michaud. In 32-bit, we use scratch fp regs to check the bounds of the input of in the truncSaturated and truncTrapping functions, before emitting the right ccall. However, the scratch fp registers are still bound when we emit the ccall, which leads to this assertion failure. These assertions only fail in debug mode and still provide the correct result in release mode because these fp registers are not used in the emitted C call. This PR implements the missing JIT calls for ARMv7 so we don't have to emit the C calls. * Source/JavaScriptCore/assembler/ARMv7Assembler.h: (JSC::ARMv7Assembler::vcmpz): (JSC::ARMv7Assembler::vmla): * Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::branchFloatWithZero): (JSC::MacroAssemblerARMv7::branchDoubleWithZero): (JSC::MacroAssemblerARMv7::convertDoubleToUint64): (JSC::MacroAssemblerARMv7::truncateDoubleToUint64): (JSC::MacroAssemblerARMv7::truncateDoubleToInt64): (JSC::MacroAssemblerARMv7::truncateFloatToUint64): (JSC::MacroAssemblerARMv7::truncateFloatToInt64): * Source/JavaScriptCore/wasm/WasmBBQJIT.h: * Source/JavaScriptCore/wasm/WasmBBQJIT32_64.cpp: (JSC::Wasm::BBQJITImpl::BBQJIT::truncInBounds): (JSC::Wasm::BBQJITImpl::BBQJIT::truncTrapping): (JSC::Wasm::BBQJITImpl::BBQJIT::truncSaturated): Canonical link: https://commits.webkit.org/299853@main
https://bugs.webkit.org/show_bug.cgi?id=301709 Reviewed by Justin Michaud. This PR improves the codegen of the shift operations (I64Shl, I64ShrS, I64ShrU) in the 32-bit implementation of BBQ: 1. The algorithm are now branchless 2. The previous version was not entirely correct when rhs/lhs' registers would alias the res registers. This new version fixes a crash on JS3's tfjs-wasm when using 32-bit JSC. tfjs-wasm is still crashing, due to a similar issue on the rotate algorithms, which I'll fix in follow-up PRs. This PR also doesn't handle cases where either lhs or rhs are constants (so we could generate more optimized code), and I have plan to fix that in the future. * Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::lshiftUnchecked): (JSC::MacroAssemblerARMv7::lshift32): (JSC::MacroAssemblerARMv7::rshiftUnchecked): (JSC::MacroAssemblerARMv7::urshiftUnchecked): (JSC::MacroAssemblerARMv7::urshift32): (JSC::MacroAssemblerARMv7::sub32): * Source/JavaScriptCore/wasm/WasmBBQJIT.h: * Source/JavaScriptCore/wasm/WasmBBQJIT32_64.cpp: (JSC::Wasm::BBQJITImpl::BBQJIT::addI64Shl): (JSC::Wasm::BBQJITImpl::BBQJIT::addI64ShrS): (JSC::Wasm::BBQJITImpl::BBQJIT::addI64ShrU): (JSC::Wasm::BBQJITImpl::BBQJIT::shiftI64Helper): Deleted. Canonical link: https://commits.webkit.org/302845@main
https://bugs.webkit.org/show_bug.cgi?id=302403 Reviewed by Yusuke Suzuki. This PR includes seveal changes to improve the codegen of store/load: * Optimized storePair to use a single move when constants are equal * Eliminated register materialization for constant integer store * Constant pointer folding when they are statically known One example where these work together is I64Store, before: [ 0x22d] I64Store 0xf1a22bcc: ldrd r1, r2, [r10, #0x34] 0xf1a22bd0: movw r0, #0x5d18 0xf1a22bd4: mov r5, r0 0xf1a22bd6: adds r5, r5, WebPlatformForEmbedded#7 0xf1a22bd8: bhs.w #0xf1a22c44 0xf1a22bdc: cmp r5, r2 0xf1a22bde: bhs.w #0xf1a22c44 0xf1a22be2: mov r5, r0 0xf1a22be4: add r5, r1 0xf1a22be6: movs r4, #0 0xf1a22be8: movs r3, #0 0xf1a22bea: str r3, [r5] 0xf1a22bec: str r4, [r5, WebPlatformForEmbedded#4] after: [ 0x22d] I64Store 0xf1b22c50: ldrd r1, r2, [r10, #0x34] 0xf1b22c54: movw r5, #0x5d1f 0xf1b22c58: cmp r5, r2 0xf1b22c5a: bhs.w #0xf1b22cc0 0xf1b22c5e: movw r12, #0x5d18 0xf1b22c62: add.w r5, r1, r12 0xf1b22c66: mov.w r12, #0 0xf1b22c6a: str.w r12, [r5] 0xf1b22c6e: str.w r12, [r5, WebPlatformForEmbedded#4] On JetStream3's tfjs-wasm.js, we reduce the code size by -9,5KiB: Base total code size: 433254 bytes (424KiB) New total code size: 423578 bytes (414KiB) Difference (new - base): -9676 bytes (-9,5KiB) Percentage change: -2.23% * Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::store16): (JSC::MacroAssemblerARMv7::storePair32): * Source/JavaScriptCore/wasm/WasmBBQJIT32_64.cpp: (JSC::Wasm::BBQJITImpl::BBQJIT::store): * Source/JavaScriptCore/wasm/WasmBBQJIT32_64.h: (JSC::Wasm::BBQJITImpl::BBQJIT::emitCheckAndPrepareAndMaterializePointerApply): Canonical link: https://commits.webkit.org/302984@main
https://bugs.webkit.org/show_bug.cgi?id=302472 Reviewed by Justin Michaud. This PR enables fused branch compare for 32-bit platforms with the goal of reducing code size. The 32-bit and 64-bit code paths are also unified with only two #if USE(JSVALUE64), emitBranchI64 is the most affected but it's minimal, we only need to pass more registers in the branch64 call. There was also only one change in the code copied from 64-bit, which was to handle GPR2 in the two addFusedIfCompare methods. This feature saves -16KiB in code size of JetStream3's tfjs-wasm.js, a -3.53% improvement: Base total code size: 439162 bytes (429KiB) New total code size: 423680 bytes (414KiB) Difference (new - base): -15482 bytes (-16KiB) Percentage change: -3.53% * Source/JavaScriptCore/assembler/ARMv7Assembler.h: (JSC::ARMv7Assembler::invert): * Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::armV7ConditionForHigh32): (JSC::MacroAssemblerARMv7::armV7ConditionForLow32): (JSC::MacroAssemblerARMv7::compare64): (JSC::MacroAssemblerARMv7::compare32AndSetFlags): (JSC::MacroAssemblerARMv7::branch64Impl): (JSC::MacroAssemblerARMv7::branch64): (JSC::MacroAssemblerARMv7::branchTest64): * Source/JavaScriptCore/wasm/WasmBBQJIT.cpp: (JSC::Wasm::BBQJITImpl::BBQJIT::tryFoldFusedBranchCompare): (JSC::Wasm::BBQJITImpl::BBQJIT::emitFusedBranchCompareBranch): (JSC::Wasm::BBQJITImpl::BBQJIT::addFusedBranchCompare): (JSC::Wasm::BBQJITImpl::BBQJIT::addFusedIfCompare): (JSC::Wasm::BBQJITImpl::emitBranchI32): (JSC::Wasm::BBQJITImpl::emitBranchI64): (JSC::Wasm::BBQJITImpl::emitBranchF32): (JSC::Wasm::BBQJITImpl::emitBranchF64): * Source/JavaScriptCore/wasm/WasmBBQJIT.h: * Source/JavaScriptCore/wasm/WasmBBQJIT32_64.cpp: (JSC::Wasm::BBQJITImpl::BBQJIT::tryFoldFusedBranchCompare): Deleted. (JSC::Wasm::BBQJITImpl::BBQJIT::emitFusedBranchCompareBranch): Deleted. (JSC::Wasm::BBQJITImpl::BBQJIT::addFusedBranchCompare): Deleted. (JSC::Wasm::BBQJITImpl::BBQJIT::addFusedIfCompare): Deleted. * Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp: (JSC::Wasm::BBQJITImpl::BBQJIT::tryFoldFusedBranchCompare): Deleted. (JSC::Wasm::BBQJITImpl::BBQJIT::emitFusedBranchCompareBranch): Deleted. (JSC::Wasm::BBQJITImpl::BBQJIT::addFusedBranchCompare): Deleted. (JSC::Wasm::BBQJITImpl::BBQJIT::addFusedIfCompare): Deleted. (JSC::Wasm::BBQJITImpl::emitBranchI32): Deleted. (JSC::Wasm::BBQJITImpl::emitBranchI64): Deleted. (JSC::Wasm::BBQJITImpl::emitBranchF32): Deleted. (JSC::Wasm::BBQJITImpl::emitBranchF64): Deleted. Canonical link: https://commits.webkit.org/303254@main
https://bugs.webkit.org/show_bug.cgi?id=293694 Reviewed by Yusuke Suzuki and Sosuke Suzuki. Not all armv7 chips are required to suport unaligned strd instructions. For example, my Neoverse N1 does not support it. This is documented at https://developer.arm.com/documentation/100748/0624/Alignment-support-in-Arm-Compiler-for-Embedded-6/Aligned-and-unaligned-accesses. We should remove these lowerings to support all armv7 processors. In the future, we may want to add them back when we can handle the alignment check separately. * Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::storePair32): Canonical link: https://commits.webkit.org/298097@main
https://bugs.webkit.org/show_bug.cgi?id=288592 Unreviewed gardening. These tests assume more RAM than is available on memoryLimited devices. * JSTests/microbenchmarks/set-delete-add.js: * JSTests/stress/regexp-escape-oom.js: * JSTests/wasm/stress/array-element-creation.js: Canonical link: https://commits.webkit.org/291116@main
https://bugs.webkit.org/show_bug.cgi?id=287677 rdar://144817380 Reviewed by Yijia Huang. 289530@main updated the handling of array_init_elem, but did not check for if the segment is null. Thus, a debug assertion within copyElementSegment could try to dereference a null pointer when checking the length. * Source/JavaScriptCore/wasm/WasmOperationsInlines.h: (JSC::Wasm::arrayInitElem): Canonical link: https://commits.webkit.org/290405@main
…nerated testmasm cases
…ction https://bugs.webkit.org/show_bug.cgi?id=296042 rdar://155947925 Reviewed by Keith Miller. The checkpoint OSR exit handler for op_instanceof was incorrectly trying to re-execute the instanceof logic instead of processing the result of the already-completed inlined call. The fix simplifies the OpInstanceof::getPrototype case to directly use the inlined call result and proceed with JSObject::defaultHasInstance(), which is the correct behavior for OSR exit handlers. In addition, both OpInstanceof::getHasInstance and OpInstanceof::instanceof should never be reached in llint_slow_path_checkpoint_osr_exit_from_inlined_call since: 1. OpInstanceof::instanceof has no inlined calls. 2. OpInstanceof::getHasInstance as the first checkpoint, the inlined call exit would directly exit to the OSR exit site in the callee and finish the callee, then resume the caller from baseline/LLInt. Originally-landed-as: 297297.141@safari-7622-branch (ed4e91038f2b). rdar://159890919 Canonical link: https://commits.webkit.org/301016@main
…c behaviour, but fix the crash.
justinmichaud
force-pushed
the
eng/wpe-246-bbq-fixes
branch
from
September 10, 2026 20:24
fb468a0 to
2c0b241
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
BBQ on 32-bit hits a few extra bugs on JS3, which was not available at the time when we cut the branch. Backport some fixes, and adapt them for 32-bit.
2c0b241