[WIP] 2.46 BBQ backports

JSTests/wasm/stress/armv7-fused-branch-compare-unsigned-ge-zero.js

@@ -0,0 +1,74 @@
+//@ requireOptions("--useBBQJIT=1", "--useWasmLLInt=0", "--useOMGJIT=0")
+
+import { instantiate } from "../wabt-wrapper.js"
+import * as assert from "../assert.js"
+
+// BBQ fuses a comparison into a following br_if/if and emits the inverted condition, so
+// the jump it hands back is the "branch not taken" edge. i64.ge_u inverts to Below, and
+// every unsigned value is >= 0, so these reach the never-taken case of
+// MacroAssemblerARMv7::branch64(Below, hi, lo, TrustedImm64(0)).
+let wat = `
+(module
+    (func (export "geUnsignedZeroBrIf") (param $x i64) (result i32)
+        (block $done
+            (br_if $done (i64.ge_u (local.get $x) (i64.const 0)))
+            (return (i32.const 0))
+        )
+        (i32.const 1)
+    )
+
+    ;; Constant on the left: i64.le_u inverts to Above, which emitBranchI64 commutes to Below.
+    (func (export "zeroLeUnsignedBrIf") (param $x i64) (result i32)
+        (block $done
+            (br_if $done (i64.le_u (i64.const 0) (local.get $x)))
+            (return (i32.const 0))
+        )
+        (i32.const 1)
+    )
+
+    ;; The if-fusion path, which stores the jump in ControlData::m_ifBranch.
+    (func (export "geUnsignedZeroIf") (param $x i64) (result i32)
+        (if (result i32) (i64.ge_u (local.get $x) (i64.const 0))
+            (then (i32.const 1))
+            (else (i32.const 0))
+        )
+    )
+
+    ;; i64.lt_u inverts to AboveOrEqual, the always-taken sibling of the case above.
+    (func (export "ltUnsignedZeroBrIf") (param $x i64) (result i32)
+        (block $done
+            (br_if $done (i64.lt_u (local.get $x) (i64.const 0)))
+            (return (i32.const 0))
+        )
+        (i32.const 1)
+    )
+
+    ;; A non-zero constant is genuinely conditional and misses the compare-with-zero paths.
+    (func (export "geUnsignedTenBrIf") (param $x i64) (result i32)
+        (block $done
+            (br_if $done (i64.ge_u (local.get $x) (i64.const 10)))
+            (return (i32.const 0))
+        )
+        (i32.const 1)
+    )
+)
+`
+
+async function test() {
+    const instance = await instantiate(wat, {}, {})
+    const { geUnsignedZeroBrIf, zeroLeUnsignedBrIf, geUnsignedZeroIf, ltUnsignedZeroBrIf, geUnsignedTenBrIf } = instance.exports
+
+    // Cover values whose high word, low word, or neither is zero.
+    for (const x of [0n, 1n, 0xffffffffn, 0x100000000n, 0xffffffff00000000n, 0xffffffffffffffffn]) {
+        assert.eq(geUnsignedZeroBrIf(x), 1)
+        assert.eq(zeroLeUnsignedBrIf(x), 1)
+        assert.eq(geUnsignedZeroIf(x), 1)
+        assert.eq(ltUnsignedZeroBrIf(x), 0)
+    }
+
+    assert.eq(geUnsignedTenBrIf(9n), 0)
+    assert.eq(geUnsignedTenBrIf(10n), 1)
+    assert.eq(geUnsignedTenBrIf(0xffffffffffffffffn), 1)
+}
+
+await assert.asyncTest(test())

JSTests/wasm/stress/array-element-creation.js

@@ -1,3 +1,4 @@
+//@ skip if $memoryLimited
 //@ runDefault("--useConcurrentJIT=0")
 
 function main() {

Source/JavaScriptCore/assembler/ARMv7Assembler.h

@@ -417,6 +417,11 @@ class ARMv7Assembler {
         ConditionInvalid
     } Condition;
 
+    static Condition invert(Condition cond)
+    {
+        return static_cast<Condition>(cond ^ 1);
+    }
+
 #define JUMP_ENUM_WITH_SIZE(index, value) (((value) << 3) | (index))
 #define JUMP_ENUM_SIZE(jump) ((jump) >> 3) 
     enum JumpType { JumpFixed = JUMP_ENUM_WITH_SIZE(0, 0), 
@@ -617,6 +622,8 @@ class ARMv7Assembler {
         OP_VLDR         = 0xED10,
         OP_VMOV_CtoS    = 0xEE00,
         OP_VMOV_StoC    = 0xEE10,
+        OP_VMLA_T2      = 0xEE00,
+        OP_VMLS_T2      = 0xEE10,
         OP_VMUL_T2      = 0xEE20,
         OP_VADD_T2      = 0xEE30,
         OP_VSUB_T2      = 0xEE30,
@@ -711,6 +718,8 @@ class ARMv7Assembler {
         OP_VLDRb         = 0x0A00,
         OP_VMOV_IMM_T2b  = 0x0A00,
         OP_VMOV_T2b      = 0x0A40,
+        OP_VMLA_T2b      = 0x0A00,
+        OP_VMLS_T2b      = 0x0A00,
         OP_VMUL_T2b      = 0x0A00,
         OP_FSTSb         = 0x0A00,
         OP_VSTRb         = 0x0A00,
@@ -2230,6 +2239,11 @@ class ARMv7Assembler {
         m_formatter.vfpOp(OP_VCMP, OP_VCMPb, true, VFPOperand(4), rd, rm);
     }
 
+    void vcmpz(FPSingleRegisterID rd)
+    {
+        m_formatter.vfpOp(OP_VCMP, OP_VCMPb, false, VFPOperand(5), rd, VFPOperand(0));
+    }
+
     void vcmpz(FPDoubleRegisterID rd)
     {
         m_formatter.vfpOp(OP_VCMP, OP_VCMPb, true, VFPOperand(5), rd, VFPOperand(0));
@@ -2344,6 +2358,11 @@ class ARMv7Assembler {
         m_formatter.vfpOp(OP_VMUL_T2, OP_VMUL_T2b, true, rn, rd, rm);
     }
 
+    void vmla(FPDoubleRegisterID rd, FPDoubleRegisterID rn, FPDoubleRegisterID rm)
+    {
+        m_formatter.vfpOp(OP_VMLA_T2, OP_VMLA_T2b, true, rn, rd, rm);
+    }
+
     void vstr(FPDoubleRegisterID rd, RegisterID rn, int32_t imm)
     {
         m_formatter.vfpMemOp(OP_VSTR, OP_VSTRb, true, rn, rd, imm);