Merge branch 'wasm-reduce-destructive' into type-reducer

Author: tlively

scripts/bundle_clusterfuzz.py

@@ -108,6 +108,7 @@
     '--disable-shared-everything',
     '--disable-fp16',
     '--disable-strings',
+    '--disable-stack-switching',
 ]
 
 with tarfile.open(output_file, "w:gz") as tar:

scripts/clusterfuzz/run.py

@@ -93,6 +93,7 @@
     '--disable-shared-everything',
     '--disable-fp16',
     '--disable-strings',
+    '--disable-stack-switching',
 ]
 
 

scripts/fuzz_opt.py

@@ -152,11 +152,13 @@ def randomize_feature_opts():
         # The shared-everything feature is new and we want to fuzz it, but it
         # also currently disables fuzzing V8, so disable it most of the time.
         # Same with strings. Relaxed SIMD's nondeterminism disables much but not
-        # all of our V8 fuzzing, so avoid it too.
+        # all of our V8 fuzzing, so avoid it too. Stack Switching, as well, is
+        # not yet ready in V8.
         if random.random() < 0.9:
             FEATURE_OPTS.append('--disable-shared-everything')
             FEATURE_OPTS.append('--disable-strings')
             FEATURE_OPTS.append('--disable-relaxed-simd')
+            FEATURE_OPTS.append('--disable-stack-switching')
 
     print('randomized feature opts:', '\n  ' + '\n  '.join(FEATURE_OPTS))
 
@@ -824,8 +826,9 @@ def run(self, wasm, extra_d8_flags=[]):
             def can_run(self, wasm):
                 # V8 does not support shared memories when running with
                 # shared-everything enabled, so do not fuzz shared-everything
-                # for now. It also does not yet support strings.
-                return all_disallowed(['shared-everything', 'strings'])
+                # for now. It also does not yet support strings, nor stack
+                # switching
+                return all_disallowed(['shared-everything', 'strings', 'stack-switching'])
 
             def can_compare_to_self(self):
                 # With nans, VM differences can confuse us, so only very simple VMs
@@ -1482,11 +1485,17 @@ def handle(self, wasm):
 
         # verify that merging in the second module did not alter the output.
         output = run_bynterp(wasm, ['--fuzz-exec-before', '-all'])
+        if output == IGNORE:
+            return
         output = fix_output(output)
         second_output = run_bynterp(second_wasm, ['--fuzz-exec-before', '-all'])
         second_output = fix_output(second_output)
+        if second_output == IGNORE:
+            return
         merged_output = run_bynterp(merged, ['--fuzz-exec-before', '-all'])
         merged_output = fix_output(merged_output)
+        if merged_output == IGNORE:
+            return
 
         # If the second module traps in instantiation, then the merged module
         # must do so as well, regardless of what the first module does. (In
@@ -1624,7 +1633,7 @@ def can_run_on_wasm(self, wasm):
             return False
 
         # see D8.can_run
-        return all_disallowed(['shared-everything', 'strings'])
+        return all_disallowed(['shared-everything', 'strings', 'stack-switching'])
 
 
 # Check that the text format round-trips without error.
@@ -1832,7 +1841,7 @@ def can_run_on_wasm(self, wasm):
             return False
         if NANS:
             return False
-        return all_disallowed(['shared-everything', 'strings'])
+        return all_disallowed(['shared-everything', 'strings', 'stack-switching'])
 
 
 # Test --fuzz-preserve-imports-exports, which never modifies imports or exports.

scripts/test/fuzzing.py

@@ -70,12 +70,6 @@
     # the fuzzer does not support imported memories
     'multi-memory-lowering-import.wast',
     'multi-memory-lowering-import-error.wast',
-    # the fuzzer does not support typed continuations
-    'typed_continuations.wast',
-    'typed_continuations_resume.wast',
-    'typed_continuations_contnew.wast',
-    'typed_continuations_contbind.wast',
-    'typed_continuations_suspend.wast',
     # the fuzzer does not support struct RMW ops
     'gc-atomics.wast',
     'gc-atomics-null-refs.wast',
@@ -96,32 +90,14 @@
     # it removes unknown imports
     'string-lifting.wast',
     'string-lifting-custom-module.wast',
-    # TODO: fuzzer support for stack switching
-    'tag_linked.wast',
-    'stack_switching.wast',
-    'stack_switching_contnew.wast',
-    'stack_switching_contbind.wast',
-    'stack_switching_suspend.wast',
-    'stack_switching_resume.wast',
-    'stack_switching_resume_throw.wast',
-    'stack_switching_switch.wast',
-    'stack_switching_switch_2.wast',
-    'O3_stack-switching.wast',
-    'coalesce-locals-stack-switching.wast',
-    'dce-stack-switching.wast',
-    'local-cse-cont.wast',
+    # TODO: fuzzer support for remaining stack switching instructions: switch,
+    #       cont.bind
+    'cont.wast',
     'precompute-stack-switching.wast',
+    'coalesce-locals-stack-switching.wast',
+    'stack_switching_switch_2.wast',
+    'stack_switching_switch.wast',
     'unsubtyping-stack-switching.wast',
-    'vacuum-stack-switching.wast',
-    'cont.wast',
-    'cont_simple.wast',
-    'gufa-cont.wast',
-    'cont_many_unhandled.wast',
-    'cont_export.wast',
-    'cont_export_throw.wast',
-    'type-merging-cont.wast',
-    'remove-unused-module-elements-cont.wast',
-    'abstract-type-refining-cont.wast',
     # TODO: fix split_wast() on tricky escaping situations like a string ending
     #       in \\" (the " is not escaped - there is an escaped \ before it)
     'string-lifting-section.wast',

src/ir/possible-contents.cpp

@@ -704,8 +704,12 @@ struct InfoCollector
   void visitRefCast(RefCast* curr) { receiveChildValue(curr->ref, curr); }
   void visitRefTest(RefTest* curr) { addRoot(curr); }
   void visitRefGetDesc(RefGetDesc* curr) {
-    // TODO: Do something more similar to struct.get here
-    addRoot(curr);
+    // Parallel to StructGet.
+    if (!isRelevant(curr->ref)) {
+      addRoot(curr);
+      return;
+    }
+    addChildParentLink(curr->ref, curr);
   }
   void visitBrOn(BrOn* curr) {
     // TODO: optimize when possible
@@ -939,6 +943,10 @@ struct InfoCollector
         return DataLocation{type, i};
       });
     }
+    if (curr->desc) {
+      info.links.push_back({ExpressionLocation{curr->desc, 0},
+                            DataLocation{type, DataLocation::DescriptorIndex}});
+    }
     addRoot(curr, PossibleContents::exactType(curr->type));
   }
   void visitArrayNew(ArrayNew* curr) {
@@ -2679,6 +2687,11 @@ void Flower::flowAfterUpdate(LocationIndex locationIndex) {
     } else if (auto* set = parent->dynCast<ArraySet>()) {
       assert(set->ref == child || set->value == child);
       writeToData(set->ref, set->value, 0);
+    } else if (auto* get = parent->dynCast<RefGetDesc>()) {
+      // Similar to struct.get.
+      assert(get->ref == child);
+      readFromData(
+        get->ref->type, DataLocation::DescriptorIndex, contents, get);
     } else {
       // TODO: ref.test and all other casts can be optimized (see the cast
       //       helper code used in OptimizeInstructions and RemoveUnusedBrs)
@@ -2839,6 +2852,10 @@ void Flower::filterGlobalContents(PossibleContents& contents,
 
 void Flower::filterDataContents(PossibleContents& contents,
                                 const DataLocation& dataLoc) {
+  if (dataLoc.index == DataLocation::DescriptorIndex) {
+    // Nothing to filter (packing is not relevant for a descriptor).
+    return;
+  }
   auto field = GCTypeUtils::getField(dataLoc.type, dataLoc.index);
   if (!field) {
     // This is a bottom type; nothing will be written here.

src/ir/possible-contents.h

@@ -481,7 +481,9 @@ struct SignatureResultLocation {
 struct DataLocation {
   HeapType type;
   // The index of the field in a struct, or 0 for an array (where we do not
-  // attempt to differentiate by index).
+  // attempt to differentiate by index). A special index is used for the
+  // descriptor field.
+  static const Index DescriptorIndex = -1;
   Index index;
   bool operator==(const DataLocation& other) const {
     return type == other.type && index == other.index;

src/passes/DeadArgumentElimination.cpp

@@ -94,6 +94,7 @@ using DAEFunctionInfoMap = std::unordered_map<Name, DAEFunctionInfo>;
 struct DAEScanner
   : public WalkerPass<PostWalker<DAEScanner, Visitor<DAEScanner>>> {
   bool isFunctionParallel() override { return true; }
+  bool modifiesBinaryenIR() override { return false; }
 
   std::unique_ptr<Pass> create() override {
     return std::make_unique<DAEScanner>(infoMap);
@@ -188,6 +189,11 @@ struct DAE : public Pass {
 
   bool optimize = false;
 
+  Index numFunctions;
+
+  // Map of function names to indexes. This lets us use indexes below for speed.
+  std::unordered_map<Name, Index> indexes;
+
   void run(Module* module) override {
     DAEFunctionInfoMap infoMap;
     // Ensure all entries exist so the parallel threads don't modify the data
@@ -198,6 +204,12 @@ struct DAE : public Pass {
     // The null name represents module-level code (not in a function).
     infoMap[Name()];
 
+    numFunctions = module->functions.size();
+
+    for (Index i = 0; i < numFunctions; i++) {
+      indexes[module->functions[i]->name] = i;
+    }
+
     // Iterate to convergence.
     while (1) {
       if (!iteration(module, infoMap)) {
@@ -233,34 +245,36 @@ struct DAE : public Pass {
       Call* call;
       Function* func;
     };
-    std::map<Name, std::vector<Call*>> allCalls;
-    std::unordered_set<Name> tailCallees;
-    std::unordered_set<Name> hasUnseenCalls;
+
+    std::vector<std::vector<Call*>> allCalls(numFunctions);
+    std::vector<bool> tailCallees(numFunctions);
+    std::vector<bool> hasUnseenCalls(numFunctions);
+
     // Track the function in which relevant expressions exist. When we modify
     // those expressions we will need to mark the function's info as stale.
     std::unordered_map<Expression*, Name> expressionFuncs;
     for (auto& [func, info] : infoMap) {
       for (auto& [name, calls] : info.calls) {
-        auto& allCallsToName = allCalls[name];
+        auto& allCallsToName = allCalls[indexes[name]];
         allCallsToName.insert(allCallsToName.end(), calls.begin(), calls.end());
         for (auto* call : calls) {
           expressionFuncs[call] = func;
         }
       }
       for (auto& callee : info.tailCallees) {
-        tailCallees.insert(callee);
+        tailCallees[indexes[callee]] = true;
       }
       for (auto& [call, dropp] : info.droppedCalls) {
         allDroppedCalls[call] = dropp;
       }
       for (auto& name : info.hasUnseenCalls) {
-        hasUnseenCalls.insert(name);
+        hasUnseenCalls[indexes[name]] = true;
       }
     }
     // Exports are considered unseen calls.
     for (auto& curr : module->exports) {
       if (curr->kind == ExternalKind::Function) {
-        hasUnseenCalls.insert(*curr->getInternalName());
+        hasUnseenCalls[indexes[*curr->getInternalName()]] = true;
       }
     }
 
@@ -299,23 +313,32 @@ struct DAE : public Pass {
 
     // We now have a mapping of all call sites for each function, and can look
     // for optimization opportunities.
-    for (auto& [name, calls] : allCalls) {
+    for (Index index = 0; index < numFunctions; index++) {
+      auto* func = module->functions[index].get();
+      if (func->imported()) {
+        continue;
+      }
       // We can only optimize if we see all the calls and can modify them.
-      if (hasUnseenCalls.count(name)) {
+      if (hasUnseenCalls[index]) {
+        continue;
+      }
+      auto& calls = allCalls[index];
+      if (calls.empty()) {
+        // Nothing calls this, so it is not worth optimizing.
         continue;
       }
-      auto* func = module->getFunction(name);
       // Refine argument types before doing anything else. This does not
       // affect whether an argument is used or not, it just refines the type
       // where possible.
+      auto name = func->name;
       if (refineArgumentTypes(func, calls, module, infoMap[name])) {
         worthOptimizing.insert(func);
         markStale(func->name);
       }
       // Refine return types as well.
       if (refineReturnTypes(func, calls, module)) {
         refinedReturnTypes = true;
-        markStale(func->name);
+        markStale(name);
         markCallersStale(calls);
       }
       auto optimizedIndexes =
@@ -336,21 +359,29 @@ struct DAE : public Pass {
       ReFinalize().run(getPassRunner(), module);
     }
     // We now know which parameters are unused, and can potentially remove them.
-    for (auto& [name, calls] : allCalls) {
-      if (hasUnseenCalls.count(name)) {
+    for (Index index = 0; index < numFunctions; index++) {
+      auto* func = module->functions[index].get();
+      if (func->imported()) {
+        continue;
+      }
+      if (hasUnseenCalls[index]) {
         continue;
       }
-      auto* func = module->getFunction(name);
       auto numParams = func->getNumParams();
       if (numParams == 0) {
         continue;
       }
+      auto& calls = allCalls[index];
+      if (calls.empty()) {
+        continue;
+      }
+      auto name = func->name;
       auto [removedIndexes, outcome] = ParamUtils::removeParameters(
         {func}, infoMap[name].unusedParams, calls, {}, module, getPassRunner());
       if (!removedIndexes.empty()) {
         // Success!
         worthOptimizing.insert(func);
-        markStale(func->name);
+        markStale(name);
         markCallersStale(calls);
       }
       if (outcome == ParamUtils::RemovalOutcome::Failure) {
@@ -362,25 +393,28 @@ struct DAE : public Pass {
     // modified allCalls (we can't modify a call site twice in one iteration,
     // once to remove a param, once to drop the return value).
     if (worthOptimizing.empty()) {
-      for (auto& func : module->functions) {
+      for (Index index = 0; index < numFunctions; index++) {
+        auto& func = module->functions[index];
+        if (func->imported()) {
+          continue;
+        }
         if (func->getResults() == Type::none) {
           continue;
         }
-        auto name = func->name;
-        if (hasUnseenCalls.count(name)) {
+        if (hasUnseenCalls[index]) {
           continue;
         }
+        auto name = func->name;
         if (infoMap[name].hasTailCalls) {
           continue;
         }
-        if (tailCallees.count(name)) {
+        if (tailCallees[index]) {
           continue;
         }
-        auto iter = allCalls.find(name);
-        if (iter == allCalls.end()) {
+        auto& calls = allCalls[index];
+        if (calls.empty()) {
           continue;
         }
-        auto& calls = iter->second;
         bool allDropped =
           std::all_of(calls.begin(), calls.end(), [&](Call* call) {
             return allDroppedCalls.count(call);
@@ -397,7 +431,7 @@ struct DAE : public Pass {
         // TODO Removing a drop may also open optimization opportunities in the
         // callers.
         worthOptimizing.insert(func.get());
-        markStale(func->name);
+        markStale(name);
         markCallersStale(calls);
       }
     }