Skip to content

Commit 692f3d5

Browse files
sjrdV8 LUCI CQ
sjrd
authored and
V8 LUCI CQ
committed
[wasm][exnref] Implement special behavior of WA.JSTag in try_table.
This commit ports the changes from 4e79015 to `CatchCase`, i.e., the `try_table` instruction. In addition, it implements the same changes in Turboshaft, for which the implementation of exceptions initially came from 2c1c14d and already contained the `JSTag` handling for `CatchException`. This commit addresses part of https://issues.chromium.org/issues/333067164 but not all. Only catching with `try_table` is fixed. `throw` remains unchanged. Change-Id: I7bad031e28eaf609fb12e7706d0b6a7cc63fa09d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5435077 Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/main@{#93303}
1 parent a6f2069 commit 692f3d5

6 files changed

Lines changed: 415 additions & 27 deletions

File tree

‎AUTHORS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -257,6 +257,7 @@ Sander Mathijs van Veen <sander@leaningtech.com>
257257
Sandro Santilli <strk@keybit.net>
258258
Sanjoy Das <sanjoy@playingwithpointers.com>
259259
Sam James <sam@gentoo.org>
260+
Sébastien Doeraene <sjrdoeraene@gmail.com>
260261
Seo Sanghyeon <sanxiyn@gmail.com>
261262
Shawn Anastasio <shawnanastasio@gmail.com>
262263
Shawn Presser <shawnpresser@gmail.com>

‎src/wasm/baseline/liftoff-compiler.cc‎

Lines changed: 95 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1637,23 +1637,104 @@ class LiftoffCompiler {
16371637
wasm::ObjectAccess::ElementOffsetInTaggedFixedArray(
16381638
catch_case.maybe_tag.tag_imm.index));
16391639

1640+
VarState exn = __ cache_state() -> stack_state.back();
1641+
16401642
CODE_COMMENT("compare tags");
1641-
{
1642-
FREEZE_STATE(frozen);
1643-
Label caught;
1644-
__ emit_cond_jump(kEqual, &caught, kRefNull, imm_tag, caught_tag.gp(),
1645-
frozen);
1646-
// The tags don't match, merge the current state into the catch state
1647-
// and jump to the next handler.
1648-
__ MergeFullStackWith(block->try_info->catch_state);
1649-
__ emit_jump(&block->try_info->catch_label);
1650-
__ bind(&caught);
1643+
if (catch_case.maybe_tag.tag_imm.tag->sig->parameter_count() == 1 &&
1644+
catch_case.maybe_tag.tag_imm.tag->sig->GetParam(0) == kWasmExternRef) {
1645+
// Check for the special case where the tag is WebAssembly.JSTag and the
1646+
// exception is not a WebAssembly.Exception. In this case the exception is
1647+
// caught and pushed on the operand stack.
1648+
// Only perform this check if the tag signature is the same as
1649+
// the JSTag signature, i.e. a single externref, otherwise we know
1650+
// statically that it cannot be the JSTag.
1651+
LiftoffRegister undefined =
1652+
pinned.set(__ GetUnusedRegister(kGpReg, pinned));
1653+
__ LoadFullPointer(
1654+
undefined.gp(), kRootRegister,
1655+
IsolateData::root_slot_offset(RootIndex::kUndefinedValue));
1656+
LiftoffRegister js_tag = pinned.set(__ GetUnusedRegister(kGpReg, pinned));
1657+
LOAD_TAGGED_PTR_INSTANCE_FIELD(js_tag.gp(), NativeContext, pinned);
1658+
__ LoadTaggedPointer(
1659+
js_tag.gp(), js_tag.gp(), no_reg,
1660+
NativeContext::SlotOffset(Context::WASM_JS_TAG_INDEX));
1661+
__ LoadTaggedPointer(
1662+
js_tag.gp(), js_tag.gp(), no_reg,
1663+
wasm::ObjectAccess::ToTagged(WasmTagObject::kTagOffset));
1664+
{
1665+
LiftoffAssembler::CacheState initial_state(zone_);
1666+
LiftoffAssembler::CacheState end_state(zone_);
1667+
Label js_exception;
1668+
Label done;
1669+
Label uncaught;
1670+
initial_state.Split(*__ cache_state());
1671+
{
1672+
FREEZE_STATE(state_merged_explicitly);
1673+
// If the tag is undefined, this is not a wasm exception. Go to a
1674+
// different block to process the JS exception. Otherwise compare it
1675+
// with the expected tag.
1676+
__ emit_cond_jump(kEqual, &js_exception, kRefNull, caught_tag.gp(),
1677+
undefined.gp(), state_merged_explicitly);
1678+
__ emit_cond_jump(kNotEqual, &uncaught, kRefNull, imm_tag,
1679+
caught_tag.gp(), state_merged_explicitly);
1680+
}
1681+
// Case 1: A wasm exception with a matching tag.
1682+
CODE_COMMENT("unpack exception");
1683+
GetExceptionValues(decoder, __ cache_state()->stack_state.back(),
1684+
catch_case.maybe_tag.tag_imm.tag);
1685+
// GetExceptionValues modified the cache state. Remember the new state
1686+
// to merge the end state of case 2 into it.
1687+
end_state.Steal(*__ cache_state());
1688+
__ emit_jump(&done);
1689+
1690+
__ bind(&js_exception);
1691+
__ cache_state() -> Split(initial_state);
1692+
{
1693+
FREEZE_STATE(state_merged_explicitly);
1694+
__ emit_cond_jump(kNotEqual, &uncaught, kRefNull, imm_tag,
1695+
js_tag.gp(), state_merged_explicitly);
1696+
}
1697+
// Case 2: A JS exception, and the expected tag is JSTag.
1698+
// TODO(thibaudm): Can we avoid some state splitting/stealing by
1699+
// reserving this register earlier and not modifying the state in this
1700+
// block?
1701+
CODE_COMMENT("JS exception caught by JSTag");
1702+
LiftoffRegister exception = __ PeekToRegister(0, pinned);
1703+
__ PushRegister(kRefNull, exception);
1704+
// The exception is now on the stack twice: once as an implicit operand
1705+
// for rethrow, and once as the "unpacked" value.
1706+
__ MergeFullStackWith(end_state);
1707+
__ emit_jump(&done);
1708+
1709+
// Case 3: Either a wasm exception with a mismatching tag, or a JS
1710+
// exception but the expected tag is not JSTag.
1711+
__ bind(&uncaught);
1712+
__ cache_state() -> Steal(initial_state);
1713+
__ MergeFullStackWith(block->try_info->catch_state);
1714+
__ emit_jump(&block->try_info->catch_label);
1715+
1716+
__ bind(&done);
1717+
__ cache_state() -> Steal(end_state);
1718+
}
1719+
} else {
1720+
{
1721+
FREEZE_STATE(frozen);
1722+
Label caught;
1723+
__ emit_cond_jump(kEqual, &caught, kRefNull, imm_tag, caught_tag.gp(),
1724+
frozen);
1725+
// The tags don't match, merge the current state into the catch state
1726+
// and jump to the next handler.
1727+
__ MergeFullStackWith(block->try_info->catch_state);
1728+
__ emit_jump(&block->try_info->catch_label);
1729+
__ bind(&caught);
1730+
}
1731+
1732+
CODE_COMMENT("unpack exception");
1733+
pinned = {};
1734+
GetExceptionValues(decoder, __ cache_state()->stack_state.back(),
1735+
catch_case.maybe_tag.tag_imm.tag);
16511736
}
16521737

1653-
CODE_COMMENT("unpack exception");
1654-
pinned = {};
1655-
VarState exn = __ cache_state()->stack_state.back();
1656-
GetExceptionValues(decoder, exn, catch_case.maybe_tag.tag_imm.tag);
16571738
if (catch_case.kind == kCatchRef) {
16581739
// Append the exception on the operand stack.
16591740
DCHECK(exn.is_stack());

‎src/wasm/graph-builder-interface.cc‎

Lines changed: 52 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1420,9 +1420,58 @@ class WasmGraphBuildingInterface {
14201420
base::Vector<Value> values_without_exnref =
14211421
catch_case.kind == kCatch ? values
14221422
: values.SubVector(0, values.size() - 1);
1423-
CatchAndUnpackWasmException(decoder, block, exception,
1424-
catch_case.maybe_tag.tag_imm.tag, caught_tag,
1425-
expected_tag, values_without_exnref);
1423+
1424+
if (catch_case.maybe_tag.tag_imm.tag->sig->parameter_count() == 1 &&
1425+
catch_case.maybe_tag.tag_imm.tag->sig->GetParam(0) == kWasmExternRef) {
1426+
// Check for the special case where the tag is WebAssembly.JSTag and the
1427+
// exception is not a WebAssembly.Exception. In this case the exception is
1428+
// caught and pushed on the operand stack.
1429+
// Only perform this check if the tag signature is the same as
1430+
// the JSTag signature, i.e. a single externref, otherwise
1431+
// we know statically that it cannot be the JSTag.
1432+
1433+
TFNode* is_js_exn = builder_->IsExceptionTagUndefined(caught_tag);
1434+
auto [exn_is_js, exn_is_wasm] = builder_->BranchExpectFalse(is_js_exn);
1435+
SsaEnv* exn_is_js_env = Split(decoder->zone(), ssa_env_);
1436+
exn_is_js_env->control = exn_is_js;
1437+
SsaEnv* exn_is_wasm_env = Steal(decoder->zone(), ssa_env_);
1438+
exn_is_wasm_env->control = exn_is_wasm;
1439+
1440+
// Case 1: A wasm exception.
1441+
SetEnv(exn_is_wasm_env);
1442+
CatchAndUnpackWasmException(decoder, block, exception,
1443+
catch_case.maybe_tag.tag_imm.tag, caught_tag,
1444+
expected_tag, values_without_exnref);
1445+
1446+
// Case 2: A JS exception.
1447+
SetEnv(exn_is_js_env);
1448+
TFNode* js_tag = builder_->LoadJSTag();
1449+
TFNode* compare = builder_->ExceptionTagEqual(expected_tag, js_tag);
1450+
auto [if_catch, if_no_catch] = builder_->BranchNoHint(compare);
1451+
// Merge the wasm no-catch and JS no-catch paths.
1452+
SsaEnv* if_no_catch_env = Split(decoder->zone(), ssa_env_);
1453+
if_no_catch_env->control = if_no_catch;
1454+
SetEnv(if_no_catch_env);
1455+
Goto(decoder, block->try_info->catch_env);
1456+
// Merge the wasm catch and JS catch paths.
1457+
SsaEnv* if_catch_env = Steal(decoder->zone(), ssa_env_);
1458+
if_catch_env->control = if_catch;
1459+
SetEnv(if_catch_env);
1460+
Goto(decoder, block->block_env);
1461+
1462+
// The final env is a merge of case 1 and 2. The unpacked value is a Phi
1463+
// of the unpacked value (case 1) and the exception itself (case 2).
1464+
SetEnv(block->block_env);
1465+
TFNode* phi_inputs[] = {values[0].node, exception,
1466+
block->block_env->control};
1467+
TFNode* ref = builder_->Phi(wasm::kWasmExternRef, 2, phi_inputs);
1468+
SetAndTypeNode(&values[0], ref);
1469+
} else {
1470+
CatchAndUnpackWasmException(decoder, block, exception,
1471+
catch_case.maybe_tag.tag_imm.tag, caught_tag,
1472+
expected_tag, values_without_exnref);
1473+
}
1474+
14261475
if (catch_case.kind == kCatchRef) {
14271476
DCHECK_EQ(values.last().type, kWasmExnRef);
14281477
values.last().node = block->try_info->exception;

‎src/wasm/turboshaft-graph-interface.cc‎

Lines changed: 63 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3013,9 +3013,10 @@ class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
30133013
BrOrRet(decoder, catch_case.br_imm.depth);
30143014
return;
30153015
}
3016+
V<NativeContext> native_context = instance_cache_.native_context();
30163017
V<WasmTagObject> caught_tag = V<WasmTagObject>::Cast(
30173018
CallBuiltinThroughJumptable<BuiltinCallDescriptor::WasmGetOwnProperty>(
3018-
decoder, instance_cache_.native_context(),
3019+
decoder, native_context,
30193020
{block->exception, LOAD_ROOT(wasm_exception_tag_symbol)}));
30203021
V<FixedArray> instance_tags =
30213022
LOAD_IMMUTABLE_INSTANCE_FIELD(trusted_instance_data(), TagsTable,
@@ -3025,17 +3026,70 @@ class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
30253026
TSBlock* if_catch = __ NewBlock();
30263027
TSBlock* if_no_catch = NewBlockWithPhis(decoder, nullptr);
30273028
SetupControlFlowEdge(decoder, if_no_catch);
3029+
3030+
// If the tags don't match we continue with the next tag by setting the
3031+
// no-catch environment as the new {block->false_or_loop_or_catch_block}
3032+
// here.
30283033
block->false_or_loop_or_catch_block = if_no_catch;
3029-
__ Branch(ConditionWithHint(__ TaggedEqual(caught_tag, expected_tag)),
3030-
if_catch, block->false_or_loop_or_catch_block);
3031-
__ Bind(if_catch);
3032-
if (catch_case.kind == kCatchRef) {
3033-
UnpackWasmException(decoder, block->exception,
3034-
values.SubVector(0, values.size() - 1));
3035-
values.last().op = block->exception;
3034+
3035+
if (catch_case.maybe_tag.tag_imm.tag->sig->parameter_count() == 1 &&
3036+
catch_case.maybe_tag.tag_imm.tag->sig->GetParam(0) == kWasmExternRef) {
3037+
// Check for the special case where the tag is WebAssembly.JSTag and the
3038+
// exception is not a WebAssembly.Exception. In this case the exception is
3039+
// caught and pushed on the operand stack.
3040+
// Only perform this check if the tag signature is the same as
3041+
// the JSTag signature, i.e. a single externref, otherwise
3042+
// we know statically that it cannot be the JSTag.
3043+
V<Word32> caught_tag_undefined =
3044+
__ TaggedEqual(caught_tag, LOAD_ROOT(UndefinedValue));
3045+
Label<Object> if_catch(&asm_);
3046+
Label<> no_catch_merge(&asm_);
3047+
3048+
IF (UNLIKELY(caught_tag_undefined)) {
3049+
V<Object> tag_object = __ Load(
3050+
native_context, LoadOp::Kind::TaggedBase(),
3051+
MemoryRepresentation::TaggedPointer(),
3052+
NativeContext::OffsetOfElementAt(Context::WASM_JS_TAG_INDEX));
3053+
V<Object> js_tag = __ Load(tag_object, LoadOp::Kind::TaggedBase(),
3054+
MemoryRepresentation::TaggedPointer(),
3055+
WasmTagObject::kTagOffset);
3056+
GOTO_IF(__ TaggedEqual(expected_tag, js_tag), if_catch,
3057+
block->exception);
3058+
GOTO(no_catch_merge);
3059+
} ELSE {
3060+
IF (__ TaggedEqual(caught_tag, expected_tag)) {
3061+
if (catch_case.kind == kCatchRef) {
3062+
UnpackWasmException(decoder, block->exception,
3063+
values.SubVector(0, values.size() - 1));
3064+
values.last().op = block->exception;
3065+
} else {
3066+
UnpackWasmException(decoder, block->exception, values);
3067+
}
3068+
GOTO(if_catch, values[0].op);
3069+
}
3070+
GOTO(no_catch_merge);
3071+
}
3072+
3073+
BIND(no_catch_merge);
3074+
__ Goto(if_no_catch);
3075+
3076+
BIND(if_catch, caught_exception);
3077+
// The first unpacked value is the exception itself in the case of a JS
3078+
// exception.
3079+
values[0].op = caught_exception;
30363080
} else {
3037-
UnpackWasmException(decoder, block->exception, values);
3081+
__ Branch(ConditionWithHint(__ TaggedEqual(caught_tag, expected_tag)),
3082+
if_catch, if_no_catch);
3083+
__ Bind(if_catch);
3084+
if (catch_case.kind == kCatchRef) {
3085+
UnpackWasmException(decoder, block->exception,
3086+
values.SubVector(0, values.size() - 1));
3087+
values.last().op = block->exception;
3088+
} else {
3089+
UnpackWasmException(decoder, block->exception, values);
3090+
}
30383091
}
3092+
30393093
BrOrRet(decoder, catch_case.br_imm.depth);
30403094

30413095
bool is_last = &catch_case == &block->catch_cases.last();

0 commit comments

Comments
 (0)