[wasm] Ship Reference Types

R=ecmziegler@chromium.org

Bug: v8:7581
Change-Id: I9acd99f3cf6832ee393d839cde7444a475a8f808
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3123409Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76565}

src/wasm/baseline/liftoff-compiler.cc

@@ -313,25 +313,11 @@ void CheckBailoutAllowed(LiftoffBailoutReason reason, const char* detail,
 #define LIST_FEATURE(name, ...) kFeature_##name,
   constexpr WasmFeatures kExperimentalFeatures{
       FOREACH_WASM_EXPERIMENTAL_FEATURE_FLAG(LIST_FEATURE)};
-  constexpr WasmFeatures kStagedFeatures{
-      FOREACH_WASM_STAGING_FEATURE_FLAG(LIST_FEATURE)};
 #undef LIST_FEATURE
 
   // Bailout is allowed if any experimental feature is enabled.
   if (env->enabled_features.contains_any(kExperimentalFeatures)) return;
 
-  // Staged features should be feature complete in Liftoff according to
-  // https://v8.dev/docs/wasm-shipping-checklist. Some are not though. They are
-  // listed here explicitly, with a bug assigned to each of them.
-
-  // TODO(7581): Fully implement reftypes in Liftoff.
-  STATIC_ASSERT(kStagedFeatures.has_reftypes());
-  if (reason == kRefTypes) {
-    DCHECK(env->enabled_features.has_reftypes());
-    return;
-  }
-
-  // Otherwise, bailout is not allowed.
   FATAL("Liftoff bailout should not happen. Cause: %s\n", detail);
 }
 

src/wasm/wasm-feature-flags.h

@@ -69,12 +69,6 @@
   /* Staged in v8.9 */                                                         \
   V(eh, "exception handling opcodes", false)                                   \
                                                                                \
-  /* Reference Types, a.k.a. reftypes proposal. */                             \
-  /* https://github.com/WebAssembly/reference-types */                         \
-  /* V8 side owner: ahaas */                                                   \
-  /* Staged in v7.8. */                                                        \
-  V(reftypes, "reference type opcodes", false)                                 \
-                                                                               \
   /* Tail call / return call proposal. */                                      \
   /* https://github.com/webassembly/tail-call */                               \
   /* V8 side owner: thibaudm */                                                \
@@ -98,6 +92,13 @@
   /* Shipped in v9.1 * */                                                      \
   V(simd, "SIMD opcodes", true)                                                \
                                                                                \
+  /* Reference Types, a.k.a. reftypes proposal. */                             \
+  /* https://github.com/WebAssembly/reference-types */                         \
+  /* V8 side owner: ahaas */                                                   \
+  /* Staged in v7.8. */                                                        \
+  /* Shipped in v9.5 * */                                                      \
+  V(reftypes, "reference type opcodes", true)                                  \
+                                                                               \
   /* Threads proposal. */                                                      \
   /* https://github.com/webassembly/threads */                                 \
   /* NOTE: This is enabled via chromium flag on desktop systems since v7.4, */ \

test/mjsunit/wasm/mutable-globals.js

@@ -21,12 +21,8 @@ function assertGlobalIsValid(global) {
   assertThrows(() => new WebAssembly.Global({}), TypeError);
   assertThrows(() => new WebAssembly.Global({value: 'foo'}), TypeError);
   assertThrows(() => new WebAssembly.Global({value: 'i128'}), TypeError);
-  // Without --experimental-wasm-reftypes, globals of type {externref} and {anyfunc}
-  // are not allowed.
-  assertThrows(() => new WebAssembly.Global({value: 'externref'}), TypeError);
-  assertThrows(() => new WebAssembly.Global({value: 'anyfunc'}), TypeError);
 
-  for (let type of ['i32', 'f32', 'f64', 'i64']) {
+  for (let type of ['i32', 'f32', 'f64', 'i64', 'externref', 'anyfunc']) {
     assertGlobalIsValid(new WebAssembly.Global({value: type}));
   }
 })();