[wasm-gc] Remove br_on_func & br_on_non_func op

Preparation step to remove the subtype relationship between funcref and anyref.

Bug: v8:7748
Change-Id: Ie4b29bfc4b874aaca668082018f5359d1b6e3a2e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3803226Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82125}

src/compiler/wasm-compiler.cc

@@ -5541,19 +5541,6 @@ void WasmGraphBuilder::BrOnData(Node* object, Node* /*rtt*/,
               });
 }
 
-void WasmGraphBuilder::BrOnFunc(Node* object, Node* /*rtt*/,
-                                WasmTypeCheckConfig config,
-                                Node** match_control, Node** match_effect,
-                                Node** no_match_control,
-                                Node** no_match_effect) {
-  BrOnCastAbs(match_control, match_effect, no_match_control, no_match_effect,
-              [=](Callbacks callbacks) -> void {
-                return ManagedObjectInstanceCheck(
-                    object, config.object_can_be_null,
-                    WASM_INTERNAL_FUNCTION_TYPE, callbacks);
-              });
-}
-
 Node* WasmGraphBuilder::RefIsArray(Node* object, bool object_can_be_null) {
   auto done = gasm_->MakeLabel(MachineRepresentation::kWord32);
   ManagedObjectInstanceCheck(object, object_can_be_null, WASM_ARRAY_TYPE,

src/compiler/wasm-compiler.h

@@ -520,9 +520,6 @@ class WasmGraphBuilder {
   void BrOnData(Node* object, Node* rtt, WasmTypeCheckConfig config,
                 Node** match_control, Node** match_effect,
                 Node** no_match_control, Node** no_match_effect);
-  void BrOnFunc(Node* object, Node* rtt, WasmTypeCheckConfig config,
-                Node** match_control, Node** match_effect,
-                Node** no_match_control, Node** no_match_effect);
   Node* RefIsArray(Node* object, bool object_can_be_null);
   Node* RefAsArray(Node* object, bool object_can_be_null,
                    wasm::WasmCodePosition position);

src/wasm/baseline/liftoff-compiler.cc

@@ -6147,11 +6147,6 @@ class LiftoffCompiler {
     BrOnAbstractType<&LiftoffCompiler::DataCheck>(object, decoder, br_depth);
   }
 
-  void BrOnFunc(FullDecoder* decoder, const Value& object,
-                Value* /* value_on_branch */, uint32_t br_depth) {
-    BrOnAbstractType<&LiftoffCompiler::FuncCheck>(object, decoder, br_depth);
-  }
-
   void BrOnI31(FullDecoder* decoder, const Value& object,
                Value* /* value_on_branch */, uint32_t br_depth) {
     BrOnAbstractType<&LiftoffCompiler::I31Check>(object, decoder, br_depth);
@@ -6167,11 +6162,6 @@ class LiftoffCompiler {
     BrOnNonAbstractType<&LiftoffCompiler::DataCheck>(object, decoder, br_depth);
   }
 
-  void BrOnNonFunc(FullDecoder* decoder, const Value& object,
-                   Value* /* value_on_branch */, uint32_t br_depth) {
-    BrOnNonAbstractType<&LiftoffCompiler::FuncCheck>(object, decoder, br_depth);
-  }
-
   void BrOnNonI31(FullDecoder* decoder, const Value& object,
                   Value* /* value_on_branch */, uint32_t br_depth) {
     BrOnNonAbstractType<&LiftoffCompiler::I31Check>(object, decoder, br_depth);

src/wasm/function-body-decoder-impl.h

@@ -1095,12 +1095,9 @@ struct ControlBase : public PcForErrors<validate> {
   F(RefAsData, const Value& object, Value* result)                             \
   F(RefAsI31, const Value& object, Value* result)                              \
   F(RefAsArray, const Value& object, Value* result)                            \
-  F(BrOnFunc, const Value& object, Value* value_on_branch, uint32_t br_depth)  \
   F(BrOnData, const Value& object, Value* value_on_branch, uint32_t br_depth)  \
   F(BrOnI31, const Value& object, Value* value_on_branch, uint32_t br_depth)   \
   F(BrOnArray, const Value& object, Value* value_on_branch, uint32_t br_depth) \
-  F(BrOnNonFunc, const Value& object, Value* value_on_fallthrough,             \
-    uint32_t br_depth)                                                         \
   F(BrOnNonData, const Value& object, Value* value_on_fallthrough,             \
     uint32_t br_depth)                                                         \
   F(BrOnNonI31, const Value& object, Value* value_on_fallthrough,              \
@@ -2035,11 +2032,9 @@ class WasmDecoder : public Decoder {
           }
           case kExprBrOnArray:
           case kExprBrOnData:
-          case kExprBrOnFunc:
           case kExprBrOnI31:
           case kExprBrOnNonArray:
           case kExprBrOnNonData:
-          case kExprBrOnNonFunc:
           case kExprBrOnNonI31: {
             BranchDepthImmediate<validate> imm(decoder, pc + length);
             if (io) io->BranchDepth(imm);
@@ -4987,7 +4982,6 @@ class WasmFullDecoder : public WasmDecoder<validate, decoding_mode> {
 #undef ABSTRACT_TYPE_CAST
 
       case kExprBrOnData:
-      case kExprBrOnFunc:
       case kExprBrOnArray:
       case kExprBrOnI31: {
         NON_CONST_ONLY
@@ -5013,12 +5007,9 @@ class WasmFullDecoder : public WasmDecoder<validate, decoding_mode> {
         Value obj = Peek(0, 0, kWasmAnyRef);
         Drop(obj);
         HeapType::Representation heap_type =
-            opcode == kExprBrOnFunc
-                ? HeapType::kFunc
-                : opcode == kExprBrOnData
-                      ? HeapType::kData
-                      : opcode == kExprBrOnArray ? HeapType::kArray
-                                                 : HeapType::kI31;
+            opcode == kExprBrOnData    ? HeapType::kData
+            : opcode == kExprBrOnArray ? HeapType::kArray
+                                       : HeapType::kI31;
         Value result_on_branch = CreateValue(ValueType::Ref(heap_type));
         Push(result_on_branch);
         if (!VALIDATE(TypeCheckBranch<true>(c, 0))) return 0;
@@ -5027,9 +5018,7 @@ class WasmFullDecoder : public WasmDecoder<validate, decoding_mode> {
         // {result_on_branch} which was passed-by-value to {Push}.
         Value* value_on_branch = stack_value(1);
         if (V8_LIKELY(current_code_reachable_and_ok_)) {
-          if (opcode == kExprBrOnFunc) {
-            CALL_INTERFACE(BrOnFunc, obj, value_on_branch, branch_depth.depth);
-          } else if (opcode == kExprBrOnData) {
+          if (opcode == kExprBrOnData) {
             CALL_INTERFACE(BrOnData, obj, value_on_branch, branch_depth.depth);
           } else if (opcode == kExprBrOnArray) {
             CALL_INTERFACE(BrOnArray, obj, value_on_branch, branch_depth.depth);
@@ -5043,7 +5032,6 @@ class WasmFullDecoder : public WasmDecoder<validate, decoding_mode> {
         return opcode_length + branch_depth.length;
       }
       case kExprBrOnNonData:
-      case kExprBrOnNonFunc:
       case kExprBrOnNonArray:
       case kExprBrOnNonI31: {
         NON_CONST_ONLY
@@ -5064,19 +5052,13 @@ class WasmFullDecoder : public WasmDecoder<validate, decoding_mode> {
 
         Value obj = Peek(0, 0, kWasmAnyRef);
         HeapType::Representation heap_type =
-            opcode == kExprBrOnNonFunc
-                ? HeapType::kFunc
-                : opcode == kExprBrOnNonData
-                      ? HeapType::kData
-                      : opcode == kExprBrOnNonArray ? HeapType::kArray
-                                                    : HeapType::kI31;
+            opcode == kExprBrOnNonData    ? HeapType::kData
+            : opcode == kExprBrOnNonArray ? HeapType::kArray
+                                          : HeapType::kI31;
         Value value_on_fallthrough = CreateValue(ValueType::Ref(heap_type));
 
         if (V8_LIKELY(current_code_reachable_and_ok_)) {
-          if (opcode == kExprBrOnNonFunc) {
-            CALL_INTERFACE(BrOnNonFunc, obj, &value_on_fallthrough,
-                           branch_depth.depth);
-          } else if (opcode == kExprBrOnNonData) {
+          if (opcode == kExprBrOnNonData) {
             CALL_INTERFACE(BrOnNonData, obj, &value_on_fallthrough,
                            branch_depth.depth);
           } else if (opcode == kExprBrOnNonArray) {

src/wasm/graph-builder-interface.cc

@@ -1308,20 +1308,6 @@ class WasmGraphBuildingInterface {
         br_depth, false);
   }
 
-  void BrOnFunc(FullDecoder* decoder, const Value& object,
-                Value* value_on_branch, uint32_t br_depth) {
-    BrOnCastAbs<&compiler::WasmGraphBuilder::BrOnFunc>(
-        decoder, object, Value{nullptr, kWasmBottom}, value_on_branch, br_depth,
-        true);
-  }
-
-  void BrOnNonFunc(FullDecoder* decoder, const Value& object,
-                   Value* value_on_fallthrough, uint32_t br_depth) {
-    BrOnCastAbs<&compiler::WasmGraphBuilder::BrOnFunc>(
-        decoder, object, Value{nullptr, kWasmBottom}, value_on_fallthrough,
-        br_depth, false);
-  }
-
   void RefIsArray(FullDecoder* decoder, const Value& object, Value* result) {
     SetAndTypeNode(
         result, builder_->RefIsArray(object.node, object.type.is_nullable()));

src/wasm/wasm-opcodes.h

@@ -716,11 +716,9 @@ bool V8_EXPORT_PRIVATE IsJSCompatibleSignature(const FunctionSig* sig,
   V(RefAsData, 0xfb59, _, "ref.as_data")                                       \
   V(RefAsI31, 0xfb5a, _, "ref.as_i31")                                         \
   V(RefAsArray, 0xfb5b, _, "ref.as_array")                                     \
-  V(BrOnFunc, 0xfb60, _, "br_on_func")                                         \
   V(BrOnData, 0xfb61, _, "br_on_data")                                         \
   V(BrOnI31, 0xfb62, _, "br_on_i31")                                           \
   V(BrOnArray, 0xfb66, _, "br_on_array")                                       \
-  V(BrOnNonFunc, 0xfb63, _, "br_on_non_func")                                  \
   V(BrOnNonData, 0xfb64, _, "br_on_non_data")                                  \
   V(BrOnNonI31, 0xfb65, _, "br_on_non_i31")                                    \
   V(BrOnNonArray, 0xfb67, _, "br_on_non_array")                                \

test/common/wasm/wasm-macro-gen.h

@@ -540,15 +540,11 @@ inline uint16_t ExtractPrefixedOpcodeBytes(WasmOpcode opcode) {
 #define WASM_REF_AS_DATA(ref) ref, WASM_GC_OP(kExprRefAsData)
 #define WASM_REF_AS_ARRAY(ref) ref, WASM_GC_OP(kExprRefAsArray)
 #define WASM_REF_AS_I31(ref) ref, WASM_GC_OP(kExprRefAsI31)
-#define WASM_BR_ON_FUNC(depth) \
-  WASM_GC_OP(kExprBrOnFunc), static_cast<byte>(depth)
 #define WASM_BR_ON_ARRAY(depth) \
   WASM_GC_OP(kExprBrOnArray), static_cast<byte>(depth)
 #define WASM_BR_ON_DATA(depth) \
   WASM_GC_OP(kExprBrOnData), static_cast<byte>(depth)
 #define WASM_BR_ON_I31(depth) WASM_GC_OP(kExprBrOnI31), static_cast<byte>(depth)
-#define WASM_BR_ON_NON_FUNC(depth) \
-  WASM_GC_OP(kExprBrOnNonFunc), static_cast<byte>(depth)
 #define WASM_BR_ON_NON_ARRAY(depth) \
   WASM_GC_OP(kExprBrOnNonArray), static_cast<byte>(depth)
 #define WASM_BR_ON_NON_DATA(depth) \

test/mjsunit/regress/wasm/regress-crbug-1339321.js

@@ -29,12 +29,12 @@ builder.addFunction("leak", kSig_l_v)
     kExprDrop,
   ]);
 
-let loop_type = builder.addType(makeSig([kWasmFuncRef], []));
+let loop_type = builder.addType(makeSig([kWasmAnyRef], []));
 builder.addFunction("crash", kSig_v_v).exportFunc().addBody([
-  kExprRefFunc, 0,
+  kExprRefNull, kAnyRefCode,
   kExprLoop, loop_type,
-    kExprRefFunc, 0,
-    kGCPrefix, kExprBrOnNonFunc, 0,
+    kExprRefNull, kAnyRefCode,
+    kGCPrefix, kExprBrOnI31, 0,
     kExprDrop,
     kExprDrop,
   kExprEnd,  // loop

test/mjsunit/wasm/wasm-module-builder.js

@@ -501,11 +501,9 @@ let kExprRefIsArray = 0x53;
 let kExprRefAsData = 0x59;
 let kExprRefAsI31 = 0x5a;
 let kExprRefAsArray = 0x5b;
-let kExprBrOnFunc = 0x60;
 let kExprBrOnData = 0x61;
 let kExprBrOnI31 = 0x62;
 let kExprBrOnArray = 0x66;
-let kExprBrOnNonFunc = 0x63;
 let kExprBrOnNonData = 0x64;
 let kExprBrOnNonI31 = 0x65;
 let kExprBrOnNonArray = 0x67;

test/unittests/wasm/function-body-decoder-unittest.cc

@@ -4387,9 +4387,6 @@ TEST_F(FunctionBodyDecoderTest, BrOnAbstractType) {
 
   ValueType kNonNullableFunc = ValueType::Ref(HeapType::kFunc);
 
-  ExpectValidates(
-      FunctionSig::Build(this->zone(), {kWasmAnyRef}, {kWasmAnyRef}),
-      {WASM_LOCAL_GET(0), WASM_BR_ON_NON_FUNC(0)});
   ExpectValidates(
       FunctionSig::Build(this->zone(), {kWasmDataRef}, {kWasmAnyRef}),
       {WASM_LOCAL_GET(0), WASM_BR_ON_DATA(0), WASM_GC_OP(kExprRefAsData)});
@@ -4405,12 +4402,12 @@ TEST_F(FunctionBodyDecoderTest, BrOnAbstractType) {
 
   // Wrong branch type.
   ExpectFailure(FunctionSig::Build(this->zone(), {}, {kWasmAnyRef}),
-                {WASM_LOCAL_GET(0), WASM_BR_ON_FUNC(0), WASM_UNREACHABLE},
+                {WASM_LOCAL_GET(0), WASM_BR_ON_DATA(0), WASM_UNREACHABLE},
                 kAppendEnd,
-                "br_on_func must target a branch of arity at least 1");
+                "br_on_data must target a branch of arity at least 1");
   ExpectFailure(
       FunctionSig::Build(this->zone(), {kNonNullableFunc}, {kWasmAnyRef}),
-      {WASM_LOCAL_GET(0), WASM_BR_ON_NON_FUNC(0)}, kAppendEnd,
+      {WASM_LOCAL_GET(0), WASM_BR_ON_NON_DATA(0)}, kAppendEnd,
       "type error in branch[0] (expected (ref func), got anyref)");
 
   // Wrong fallthrough type.