246 proposed backports

JSTests/stress/tail-call-register-pressure.js

@@ -0,0 +1,137 @@
+"use strict";
+
+function getModuleExports() {
+    return () => {}
+};
+
+function ownKeys(ee, te) {
+    var re = Object.keys(ee);
+    if (Object.getOwnPropertySymbols) {
+        var ne = Object.getOwnPropertySymbols(ee);
+        te && (ne = ne.filter((function(te) {
+            return Object.getOwnPropertyDescriptor(ee, te).enumerable
+        }))),
+        re.push.apply(re, ne)
+    }
+    return re
+}
+
+function _objectSpread(ee) {
+    for (var te = 1; te < arguments.length; te++) {
+        var re = null != arguments[te] ? arguments[te] : {};
+        te % 2 ? ownKeys(Object(re), !0).forEach((function(te) {
+            getModuleExports()(ee, te, re[te])
+        })) : Object.getOwnPropertyDescriptors ? Object.defineProperties(ee, Object.getOwnPropertyDescriptors(re)) : ownKeys(Object(re)).forEach((function(te) {
+            Object.defineProperty(ee, te, Object.getOwnPropertyDescriptor(re, te))
+        }))
+    }
+    return ee
+}
+
+var ae = {
+    cleanAndTrimSelfLink: function() {
+    }
+};
+
+var browseItems = function(ee, te, re) {
+    function parseBrowseItem(ee, te, re, ne, ie) {
+        var ce, le, de, he;
+        if (ee.hasEmbedded("linearInfo")) {
+            var fe = ee.getEmbedded("linearInfo"),
+                pe = Object(ae.cleanSelfLink)(fe.getFirstAction("channel").getRawActionUrl());
+            if (!ne[pe] && !ie) return;
+        }
+
+        var ge = function parseBrowseItemUrl(ee, te) {
+            var re = ee.getProp("entityId"),
+                ne = ee.getProp("entityType"),
+                ie = ee.getProp("seriesProgramId"),
+                oe = ee.getProp("_type");
+            return "entity/".concat(re)
+        }(ee, he),
+            me = ee.getProps();
+        if (("NETWORK" !== te || ee.hasEmbedded("contentProvider")) && ("3X4_PROGRAM_LINEAR" !== te || ee.hasEmbedded("linearInfo"))) {
+            var ve = ee.hasAction("programImageLink") ? ee.getFirstAction("programImageLink") : re.programImageLink,
+                Se = ee.hasAction("programFallbackImageLink"),
+                _t = Se ? ee.getFirstAction("programFallbackImageLink") : re.programFallbackImageLink;
+
+            var Et, kt, Tt, Pt = _t.setParams(de).getActionUrl();
+            return Et = Se ? Pt : ve.setParams(de).getActionUrl(), me.contentRating && me.contentRatingScheme && (kt = {
+                scheme: me.contentRatingScheme,
+                name: me.contentRating
+            }), (null === (ce = me.ordering) || void 0 === ce ? void 0 : ce.criticScore) && (null === (le = me.ordering) || void 0 === le ? void 0 : le.fanScore) && (Tt = {
+                rt: {
+                    criticScore: Math.floor(me.ordering.criticScore),
+                    criticCertified: Math.floor(me.ordering.criticScore) >= 75,
+                    criticRotten: Math.floor(me.ordering.criticScore) < 60,
+                    fanScore: Math.floor(me.ordering.fanScore),
+                    fanRotten: Math.floor(me.ordering.fanScore) < 60
+                }
+            }), _objectSpread({
+                _type: me._type
+            }, me.adBrand && {
+                adBrand: me.adBrand
+            }, {}, me.entityId && {
+                entityId: me.entityId
+            }, {}, me.entityType && {
+                entityType: me.entityType
+            }, {}, me.episodeNumber && {
+                episodeNumber: me.episodeNumber
+            }, {}, he && {
+                linearInfo: he
+            }, {}, me.numberOfEpisodes && {
+                numberOfEpisodes: me.numberOfEpisodes
+            }, {}, me.programType && {
+                programType: me.programType
+            }, {}, kt && {
+                rating: kt
+            }, {}, Tt && {
+                reviews: Tt
+            }, {}, me.hasDVS && {
+                dvs: me.hasDVS
+            }, {}, me.isHD && {
+                hd: me.isHD
+            }, {}, me.closedCaption && {
+                cc: me.closedCaption
+            }, {}, me.isSAP && {
+                sap: me.isSAP
+            }, {}, me.releaseYear && {
+                releaseYear: me.releaseYear
+            }, {}, me.seasonNumber && {
+                seasonNumber: me.seasonNumber
+            }, {}, me.seriesTitle && {
+                seriesTitle: me.seriesTitle
+            }, {}, {
+                tileRenderStyle: me.tileRenderStyle || te,
+                title: me.title,
+                subtitle: me.subtitle,
+                image: Et,
+                fallbackImage: Pt,
+                url: ge
+            })
+        }
+    }
+
+    return parseBrowseItem(ee, te, re,{},{})
+}
+
+const runTest = function() {
+    for (var i = 1; i < 100; ++i) {
+        browseItems(
+            {
+                hasAction: () => {},
+                hasEmbedded: (i) => { return i === "contentProvider"; },
+                getProp: () => { return undefined },
+                getProps: () => { return {} },
+                getFirstAction: () => { return { getRawActionUrl: () => "url" } },
+            },
+            {},
+            {
+                programImageLink: { setParams: () => { return { getActionUrl: () => "programImageLink" }; } },
+                programFallbackImageLink: { setParams: () => { return { getActionUrl: () => "programFallbackImageLinkrl" }; } },
+            }
+        )
+    }
+}
+
+runTest()

JSTests/wasm/stress/bbq-i64-unaligned-load-store.js

@@ -0,0 +1,29 @@
+//@ requireOptions("--useConcurrentJIT=false")
+// Regression test for unaligned i64 memory access under BBQ on ARMv7.
+// BBQ compiled wasm i64.load/i64.store with ldrd/strd, which fault on unaligned
+// addresses on ARMv7 -- but wasm permits unaligned memory access. Round-tripping an
+// i64 through an unaligned address therefore crashed (SIGBUS) once BBQ kicked in.
+
+// (module
+//   (memory 1)
+//   (func (export "roundtrip") (param $off i32) (param $v i64) (result i64)
+//     local.get $off local.get $v i64.store
+//     local.get $off i64.load))
+const bytes = new Uint8Array([
+    0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00, // \0asm v1
+    0x01, 0x07, 0x01, 0x60, 0x02, 0x7f, 0x7e, 0x01, 0x7e, // type: (i32,i64)->i64
+    0x03, 0x02, 0x01, 0x00, // func 0
+    0x05, 0x03, 0x01, 0x00, 0x01, // memory: min 1 page
+    0x07, 0x0d, 0x01, 0x09, 0x72, 0x6f, 0x75, 0x6e, 0x64, 0x74, 0x72, 0x69, 0x70, 0x00, 0x00, // export "roundtrip"
+    0x0a, 0x10, 0x01, 0x0e, 0x00, 0x20, 0x00, 0x20, 0x01, 0x37, 0x03, 0x00, 0x20, 0x00, 0x29, 0x03, 0x00, 0x0b, // code
+]);
+
+const { roundtrip } = new WebAssembly.Instance(new WebAssembly.Module(bytes)).exports;
+
+const V = 0x1122334455667788n;
+for (let i = 0; i < 100000; i++) {
+    // offset 1 is unaligned; ldrd/strd would fault on ARMv7 once BBQ-compiled.
+    const got = roundtrip(1, V);
+    if (got !== V)
+        throw new Error("unaligned i64 roundtrip at iteration " + i + ": got 0x" + got.toString(16));
+}

JSTests/wasm/stress/omg-array-new-i32-init.js

@@ -0,0 +1,31 @@
+//@ requireOptions("--useConcurrentJIT=false")
+// Regression test for array.new with a 32-bit init value under OMG on ARMv7.
+// operationWasmArrayNew() takes the init value as a uint64_t. The 32-bit OMG
+// generator passed an i32 init as a single word, so the ABI put it in a register
+// while the callee read the uint64_t from an uninitialized stack slot -- filling
+// the array with a stray value instead of the requested init.
+
+// (module
+//   (type $arr (array (mut i32)))
+//   (func (export "f") (param i32) (result i32)
+//     local.get 0
+//     i32.const 3
+//     array.new $arr
+//     i32.const 1
+//     array.get $arr))
+const bytes = new Uint8Array([
+    0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00, // \0asm v1
+    0x01, 0x09, 0x02, 0x5e, 0x7f, 0x01, 0x60, 0x01, 0x7f, 0x01, 0x7f, // type: array(mut i32); (i32)->i32
+    0x03, 0x02, 0x01, 0x01, // func 0 has type 1
+    0x07, 0x05, 0x01, 0x01, 0x66, 0x00, 0x00, // export "f"
+    0x0a, 0x10, 0x01, 0x0e, 0x00, 0x20, 0x00, 0x41, 0x03, 0xfb, 0x06, 0x00, 0x41, 0x01, 0xfb, 0x0b, 0x00, 0x0b, // code
+]);
+
+const f = new WebAssembly.Instance(new WebAssembly.Module(bytes)).exports.f;
+
+for (let i = 0; i < 100000; i++) {
+    // f(v) allocates i32[3] filled with v and returns element 1, which must equal v.
+    const got = f(0x2a);
+    if (got !== 0x2a)
+        throw new Error("array.new i32 init: f(0x2a) should be 0x2a, got " + got + " at iteration " + i);
+}

JSTests/wasm/stress/omg-test32-distinct-registers.js

@@ -0,0 +1,33 @@
+//@ requireOptions("--useConcurrentJIT=false")
+// Regression test for test32(Zero/NonZero, op1, op2, dest) with op1 != op2 on ARMv7:
+// materializing (op1 & op2) == 0 must use AND, not EOR (EOR computes op1 == op2).
+// OMG fuses i32.eqz(i32.and(a, b)) into a single materialized Test32, which is the
+// only tier that exercises the distinct-register form.
+// https://bugs.webkit.org/show_bug.cgi?id=302016 (regressed in 303329@main)
+
+// (module
+//   (func (export "f") (param i32 i32) (result i32)
+//     local.get 0
+//     local.get 1
+//     i32.and
+//     i32.eqz))
+const bytes = new Uint8Array([
+    0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00, // \0asm v1
+    0x01, 0x07, 0x01, 0x60, 0x02, 0x7f, 0x7f, 0x01, 0x7f, // type: (i32,i32)->i32
+    0x03, 0x02, 0x01, 0x00, // func
+    0x07, 0x05, 0x01, 0x01, 0x66, 0x00, 0x00, // export "f"
+    0x0a, 0x0a, 0x01, 0x08, 0x00, 0x20, 0x00, 0x20, 0x01, 0x71, 0x45, 0x0b, // code
+]);
+
+const f = new WebAssembly.Instance(new WebAssembly.Module(bytes)).exports.f;
+
+for (let i = 0; i < 300000; i++) {
+    // (2 & 1) == 0, but 2 != 1: EOR-based Zero materialization returns 0 instead of 1.
+    let got = f(2, 1);
+    if (got !== 1)
+        throw new Error("f(2, 1) should be 1 ((2&1)==0), got " + got + " at iteration " + i);
+    // (3 & 1) != 0 and 3 != 1: both idioms agree; guards the NonZero path shape too.
+    got = f(3, 1);
+    if (got !== 0)
+        throw new Error("f(3, 1) should be 0 ((3&1)!=0), got " + got + " at iteration " + i);
+}