[WIP] 2.46 BBQ backports

JSTests/stress/instanceof-osr-exit-hasInstance-getter.js

@@ -0,0 +1,19 @@
+function F1() {
+    Object instanceof Proxy;
+}
+noInline(F1);
+
+let count = 0;
+function f20() {
+    count++;
+    OSRExit();
+    return () => { };
+}
+Object.defineProperty(Proxy, Symbol.hasInstance, { get: f20 });
+
+globalThis.testLoopCount ??= 1e4;
+for (let i = 0; i < testLoopCount; i++) {
+    F1();
+}
+if (count != testLoopCount)
+    throw new Error("bad!");

JSTests/stress/instanceof-osr-exit-prototype-getter.js

@@ -0,0 +1,19 @@
+function F1() {
+    Object instanceof Proxy;
+}
+noInline(F1);
+
+let count = 0;
+function f20() {
+    count++;
+    OSRExit();
+    return f20;
+}
+Object.defineProperty(Proxy, "prototype", { get: f20 });
+
+globalThis.testLoopCount ??= 1e4;
+for (let i = 0; i < testLoopCount; i++) {
+    F1();
+}
+if (count != testLoopCount)
+    throw new Error("bad!");

JSTests/stress/proxy-ic-does-not-clobber-callee-saves.js

@@ -0,0 +1,88 @@
+// A proxy inline cache emits a JS call, and values the enclosing JIT holds in callee save registers
+// have to survive it. Each function below keeps more live integers than ARMv7 has allocatable GPRs,
+// so some of them land in the registers that hold metadataTable and jitData there.
+
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error(`bad value: ${actual}, expected ${expected}`);
+}
+
+const handler = {
+    get(target, property) {
+        return target[property];
+    },
+    set(target, property, value) {
+        target[property] = value;
+        return true;
+    },
+};
+
+const loadProxy = new Proxy({ field: 42 }, handler);
+const indexedProxy = new Proxy({ 0: 7 }, handler);
+const storeProxy = new Proxy({ field: 0 }, handler);
+
+function load(proxy, x) {
+    const v0 = (x + 1) | 0;
+    const v1 = (x + 2) | 0;
+    const v2 = (x + 3) | 0;
+    const v3 = (x + 4) | 0;
+    const v4 = (x + 5) | 0;
+    const v5 = (x + 6) | 0;
+    const v6 = (x + 7) | 0;
+    const v7 = (x + 8) | 0;
+    const v8 = (x + 9) | 0;
+    const v9 = (x + 10) | 0;
+    const v10 = (x + 11) | 0;
+    const v11 = (x + 12) | 0;
+    const got = proxy.field;
+    return (v0 + v1 + v2 + v3 + v4 + v5 + v6 + v7 + v8 + v9 + v10 + v11 + got) | 0;
+}
+noInline(load);
+
+function loadByVal(proxy, x, index) {
+    const v0 = (x + 1) | 0;
+    const v1 = (x + 2) | 0;
+    const v2 = (x + 3) | 0;
+    const v3 = (x + 4) | 0;
+    const v4 = (x + 5) | 0;
+    const v5 = (x + 6) | 0;
+    const v6 = (x + 7) | 0;
+    const v7 = (x + 8) | 0;
+    const v8 = (x + 9) | 0;
+    const v9 = (x + 10) | 0;
+    const v10 = (x + 11) | 0;
+    const v11 = (x + 12) | 0;
+    const got = proxy[index];
+    return (v0 + v1 + v2 + v3 + v4 + v5 + v6 + v7 + v8 + v9 + v10 + v11 + got) | 0;
+}
+noInline(loadByVal);
+
+function store(proxy, x) {
+    const v0 = (x + 1) | 0;
+    const v1 = (x + 2) | 0;
+    const v2 = (x + 3) | 0;
+    const v3 = (x + 4) | 0;
+    const v4 = (x + 5) | 0;
+    const v5 = (x + 6) | 0;
+    const v6 = (x + 7) | 0;
+    const v7 = (x + 8) | 0;
+    const v8 = (x + 9) | 0;
+    const v9 = (x + 10) | 0;
+    const v10 = (x + 11) | 0;
+    const v11 = (x + 12) | 0;
+    proxy.field = x;
+    return (v0 + v1 + v2 + v3 + v4 + v5 + v6 + v7 + v8 + v9 + v10 + v11) | 0;
+}
+noInline(store);
+
+// The first call runs before any inline cache exists, so its result is the oracle for every tier.
+const expectedLoad = load(loadProxy, 1);
+const expectedLoadByVal = loadByVal(indexedProxy, 1, 0);
+const expectedStore = store(storeProxy, 1);
+
+for (let i = 0; i < 5e4; ++i) {
+    shouldBe(load(loadProxy, 1), expectedLoad);
+    shouldBe(loadByVal(indexedProxy, 1, 0), expectedLoadByVal);
+    shouldBe(store(storeProxy, 1), expectedStore);
+    shouldBe(storeProxy.field, 1);
+}

JSTests/stress/tail-call-register-pressure.js

@@ -0,0 +1,137 @@
+"use strict";
+
+function getModuleExports() {
+    return () => {}
+};
+
+function ownKeys(ee, te) {
+    var re = Object.keys(ee);
+    if (Object.getOwnPropertySymbols) {
+        var ne = Object.getOwnPropertySymbols(ee);
+        te && (ne = ne.filter((function(te) {
+            return Object.getOwnPropertyDescriptor(ee, te).enumerable
+        }))),
+        re.push.apply(re, ne)
+    }
+    return re
+}
+
+function _objectSpread(ee) {
+    for (var te = 1; te < arguments.length; te++) {
+        var re = null != arguments[te] ? arguments[te] : {};
+        te % 2 ? ownKeys(Object(re), !0).forEach((function(te) {
+            getModuleExports()(ee, te, re[te])
+        })) : Object.getOwnPropertyDescriptors ? Object.defineProperties(ee, Object.getOwnPropertyDescriptors(re)) : ownKeys(Object(re)).forEach((function(te) {
+            Object.defineProperty(ee, te, Object.getOwnPropertyDescriptor(re, te))
+        }))
+    }
+    return ee
+}
+
+var ae = {
+    cleanAndTrimSelfLink: function() {
+    }
+};
+
+var browseItems = function(ee, te, re) {
+    function parseBrowseItem(ee, te, re, ne, ie) {
+        var ce, le, de, he;
+        if (ee.hasEmbedded("linearInfo")) {
+            var fe = ee.getEmbedded("linearInfo"),
+                pe = Object(ae.cleanSelfLink)(fe.getFirstAction("channel").getRawActionUrl());
+            if (!ne[pe] && !ie) return;
+        }
+
+        var ge = function parseBrowseItemUrl(ee, te) {
+            var re = ee.getProp("entityId"),
+                ne = ee.getProp("entityType"),
+                ie = ee.getProp("seriesProgramId"),
+                oe = ee.getProp("_type");
+            return "entity/".concat(re)
+        }(ee, he),
+            me = ee.getProps();
+        if (("NETWORK" !== te || ee.hasEmbedded("contentProvider")) && ("3X4_PROGRAM_LINEAR" !== te || ee.hasEmbedded("linearInfo"))) {
+            var ve = ee.hasAction("programImageLink") ? ee.getFirstAction("programImageLink") : re.programImageLink,
+                Se = ee.hasAction("programFallbackImageLink"),
+                _t = Se ? ee.getFirstAction("programFallbackImageLink") : re.programFallbackImageLink;
+
+            var Et, kt, Tt, Pt = _t.setParams(de).getActionUrl();
+            return Et = Se ? Pt : ve.setParams(de).getActionUrl(), me.contentRating && me.contentRatingScheme && (kt = {
+                scheme: me.contentRatingScheme,
+                name: me.contentRating
+            }), (null === (ce = me.ordering) || void 0 === ce ? void 0 : ce.criticScore) && (null === (le = me.ordering) || void 0 === le ? void 0 : le.fanScore) && (Tt = {
+                rt: {
+                    criticScore: Math.floor(me.ordering.criticScore),
+                    criticCertified: Math.floor(me.ordering.criticScore) >= 75,
+                    criticRotten: Math.floor(me.ordering.criticScore) < 60,
+                    fanScore: Math.floor(me.ordering.fanScore),
+                    fanRotten: Math.floor(me.ordering.fanScore) < 60
+                }
+            }), _objectSpread({
+                _type: me._type
+            }, me.adBrand && {
+                adBrand: me.adBrand
+            }, {}, me.entityId && {
+                entityId: me.entityId
+            }, {}, me.entityType && {
+                entityType: me.entityType
+            }, {}, me.episodeNumber && {
+                episodeNumber: me.episodeNumber
+            }, {}, he && {
+                linearInfo: he
+            }, {}, me.numberOfEpisodes && {
+                numberOfEpisodes: me.numberOfEpisodes
+            }, {}, me.programType && {
+                programType: me.programType
+            }, {}, kt && {
+                rating: kt
+            }, {}, Tt && {
+                reviews: Tt
+            }, {}, me.hasDVS && {
+                dvs: me.hasDVS
+            }, {}, me.isHD && {
+                hd: me.isHD
+            }, {}, me.closedCaption && {
+                cc: me.closedCaption
+            }, {}, me.isSAP && {
+                sap: me.isSAP
+            }, {}, me.releaseYear && {
+                releaseYear: me.releaseYear
+            }, {}, me.seasonNumber && {
+                seasonNumber: me.seasonNumber
+            }, {}, me.seriesTitle && {
+                seriesTitle: me.seriesTitle
+            }, {}, {
+                tileRenderStyle: me.tileRenderStyle || te,
+                title: me.title,
+                subtitle: me.subtitle,
+                image: Et,
+                fallbackImage: Pt,
+                url: ge
+            })
+        }
+    }
+
+    return parseBrowseItem(ee, te, re,{},{})
+}
+
+const runTest = function() {
+    for (var i = 1; i < 100; ++i) {
+        browseItems(
+            {
+                hasAction: () => {},
+                hasEmbedded: (i) => { return i === "contentProvider"; },
+                getProp: () => { return undefined },
+                getProps: () => { return {} },
+                getFirstAction: () => { return { getRawActionUrl: () => "url" } },
+            },
+            {},
+            {
+                programImageLink: { setParams: () => { return { getActionUrl: () => "programImageLink" }; } },
+                programFallbackImageLink: { setParams: () => { return { getActionUrl: () => "programFallbackImageLinkrl" }; } },
+            }
+        )
+    }
+}
+
+runTest()

JSTests/wasm/stress/armv7-fused-branch-compare-unsigned-ge-zero.js

@@ -0,0 +1,74 @@
+//@ requireOptions("--useBBQJIT=1", "--useWasmLLInt=0", "--useOMGJIT=0")
+
+import { instantiate } from "../wabt-wrapper.js"
+import * as assert from "../assert.js"
+
+// BBQ fuses a comparison into a following br_if/if and emits the inverted condition, so
+// the jump it hands back is the "branch not taken" edge. i64.ge_u inverts to Below, and
+// every unsigned value is >= 0, so these reach the never-taken case of
+// MacroAssemblerARMv7::branch64(Below, hi, lo, TrustedImm64(0)).
+let wat = `
+(module
+    (func (export "geUnsignedZeroBrIf") (param $x i64) (result i32)
+        (block $done
+            (br_if $done (i64.ge_u (local.get $x) (i64.const 0)))
+            (return (i32.const 0))
+        )
+        (i32.const 1)
+    )
+
+    ;; Constant on the left: i64.le_u inverts to Above, which emitBranchI64 commutes to Below.
+    (func (export "zeroLeUnsignedBrIf") (param $x i64) (result i32)
+        (block $done
+            (br_if $done (i64.le_u (i64.const 0) (local.get $x)))
+            (return (i32.const 0))
+        )
+        (i32.const 1)
+    )
+
+    ;; The if-fusion path, which stores the jump in ControlData::m_ifBranch.
+    (func (export "geUnsignedZeroIf") (param $x i64) (result i32)
+        (if (result i32) (i64.ge_u (local.get $x) (i64.const 0))
+            (then (i32.const 1))
+            (else (i32.const 0))
+        )
+    )
+
+    ;; i64.lt_u inverts to AboveOrEqual, the always-taken sibling of the case above.
+    (func (export "ltUnsignedZeroBrIf") (param $x i64) (result i32)
+        (block $done
+            (br_if $done (i64.lt_u (local.get $x) (i64.const 0)))
+            (return (i32.const 0))
+        )
+        (i32.const 1)
+    )
+
+    ;; A non-zero constant is genuinely conditional and misses the compare-with-zero paths.
+    (func (export "geUnsignedTenBrIf") (param $x i64) (result i32)
+        (block $done
+            (br_if $done (i64.ge_u (local.get $x) (i64.const 10)))
+            (return (i32.const 0))
+        )
+        (i32.const 1)
+    )
+)
+`
+
+async function test() {
+    const instance = await instantiate(wat, {}, {})
+    const { geUnsignedZeroBrIf, zeroLeUnsignedBrIf, geUnsignedZeroIf, ltUnsignedZeroBrIf, geUnsignedTenBrIf } = instance.exports
+
+    // Cover values whose high word, low word, or neither is zero.
+    for (const x of [0n, 1n, 0xffffffffn, 0x100000000n, 0xffffffff00000000n, 0xffffffffffffffffn]) {
+        assert.eq(geUnsignedZeroBrIf(x), 1)
+        assert.eq(zeroLeUnsignedBrIf(x), 1)
+        assert.eq(geUnsignedZeroIf(x), 1)
+        assert.eq(ltUnsignedZeroBrIf(x), 0)
+    }
+
+    assert.eq(geUnsignedTenBrIf(9n), 0)
+    assert.eq(geUnsignedTenBrIf(10n), 1)
+    assert.eq(geUnsignedTenBrIf(0xffffffffffffffffn), 1)
+}
+
+await assert.asyncTest(test())

JSTests/wasm/stress/array-element-creation.js

@@ -1,3 +1,4 @@
+//@ skip if $memoryLimited
 //@ runDefault("--useConcurrentJIT=0")
 
 function main() {