[wasm] Torqueify wasm Table.init and Table.copy builtins.

Bug: v8:9891

Change-Id: I9fda15122fc4f24e237af6bfc00eb529ae37cb01
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2177512
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67901}

src/builtins/base.tq

@@ -918,6 +918,7 @@ extern macro SmiToTaggedIndex(Smi): TaggedIndex;
 extern macro RoundIntPtrToFloat64(intptr): float64;
 extern macro ChangeFloat32ToFloat64(float32): float64;
 extern macro ChangeNumberToFloat64(Number): float64;
+extern macro ChangeNumberToUint32(Number): uint32;
 extern macro ChangeTaggedNonSmiToInt32(implicit context: Context)(JSAnyNotSmi):
     int32;
 extern macro ChangeTaggedToFloat64(implicit context: Context)(JSAny): float64;

src/builtins/builtins-definitions.h

@@ -851,8 +851,6 @@ namespace internal {
   TFS(WasmAllocateArray, kMapIndex, kLength, kElementSize)                     \
   TFC(WasmI32AtomicWait32, WasmI32AtomicWait32)                                \
   TFC(WasmI64AtomicWait32, WasmI64AtomicWait32)                                \
-  TFC(WasmTableInit, WasmTableInit)                                            \
-  TFC(WasmTableCopy, WasmTableCopy)                                            \
                                                                                \
   /* WeakMap */                                                                \
   TFJ(WeakMapConstructor, kDontAdaptArgumentsSentinel)                         \

src/builtins/builtins-wasm-gen.cc

@@ -43,14 +43,6 @@ TNode<FixedArray> WasmBuiltinsAssembler::LoadManagedObjectMapsFromInstance(
       instance, WasmInstanceObject::kManagedObjectMapsOffset);
 }
 
-TNode<Smi> WasmBuiltinsAssembler::SmiFromUint32WithSaturation(
-    TNode<Uint32T> value, uint32_t max) {
-  DCHECK_LE(max, static_cast<uint32_t>(Smi::kMaxValue));
-  TNode<Uint32T> capped_value = SelectConstant(
-      Uint32LessThan(value, Uint32Constant(max)), value, Uint32Constant(max));
-  return SmiFromUint32(capped_value);
-}
-
 TF_BUILTIN(WasmFloat32ToNumber, WasmBuiltinsAssembler) {
   TNode<Float32T> val = UncheckedCast<Float32T>(Parameter(Descriptor::kValue));
   Return(ChangeFloat32ToTagged(val));
@@ -122,66 +114,6 @@ TF_BUILTIN(WasmI64AtomicWait32, WasmBuiltinsAssembler) {
   Return(Unsigned(SmiToInt32(result_smi)));
 }
 
-TF_BUILTIN(WasmTableInit, WasmBuiltinsAssembler) {
-  TNode<Uint32T> dst_raw =
-      UncheckedCast<Uint32T>(Parameter(Descriptor::kDestination));
-  // We cap {dst}, {src}, and {size} by {wasm::kV8MaxWasmTableSize + 1} to make
-  // sure that the values fit into a Smi.
-  STATIC_ASSERT(static_cast<size_t>(Smi::kMaxValue) >=
-                wasm::kV8MaxWasmTableSize + 1);
-  constexpr uint32_t kCap =
-      static_cast<uint32_t>(wasm::kV8MaxWasmTableSize + 1);
-  TNode<Smi> dst = SmiFromUint32WithSaturation(dst_raw, kCap);
-  TNode<Uint32T> src_raw =
-      UncheckedCast<Uint32T>(Parameter(Descriptor::kSource));
-  TNode<Smi> src = SmiFromUint32WithSaturation(src_raw, kCap);
-  TNode<Uint32T> size_raw =
-      UncheckedCast<Uint32T>(Parameter(Descriptor::kSize));
-  TNode<Smi> size = SmiFromUint32WithSaturation(size_raw, kCap);
-  TNode<Smi> table_index =
-      UncheckedCast<Smi>(Parameter(Descriptor::kTableIndex));
-  TNode<Smi> segment_index =
-      UncheckedCast<Smi>(Parameter(Descriptor::kSegmentIndex));
-  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
-  TNode<Context> context = LoadContextFromInstance(instance);
-
-  TailCallRuntime(Runtime::kWasmTableInit, context, instance, table_index,
-                  segment_index, dst, src, size);
-}
-
-TF_BUILTIN(WasmTableCopy, WasmBuiltinsAssembler) {
-  // We cap {dst}, {src}, and {size} by {wasm::kV8MaxWasmTableSize + 1} to make
-  // sure that the values fit into a Smi.
-  STATIC_ASSERT(static_cast<size_t>(Smi::kMaxValue) >=
-                wasm::kV8MaxWasmTableSize + 1);
-  constexpr uint32_t kCap =
-      static_cast<uint32_t>(wasm::kV8MaxWasmTableSize + 1);
-
-  TNode<Uint32T> dst_raw =
-      UncheckedCast<Uint32T>(Parameter(Descriptor::kDestination));
-  TNode<Smi> dst = SmiFromUint32WithSaturation(dst_raw, kCap);
-
-  TNode<Uint32T> src_raw =
-      UncheckedCast<Uint32T>(Parameter(Descriptor::kSource));
-  TNode<Smi> src = SmiFromUint32WithSaturation(src_raw, kCap);
-
-  TNode<Uint32T> size_raw =
-      UncheckedCast<Uint32T>(Parameter(Descriptor::kSize));
-  TNode<Smi> size = SmiFromUint32WithSaturation(size_raw, kCap);
-
-  TNode<Smi> dst_table =
-      UncheckedCast<Smi>(Parameter(Descriptor::kDestinationTable));
-
-  TNode<Smi> src_table =
-      UncheckedCast<Smi>(Parameter(Descriptor::kSourceTable));
-
-  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
-  TNode<Context> context = LoadContextFromInstance(instance);
-
-  TailCallRuntime(Runtime::kWasmTableCopy, context, instance, dst_table,
-                  src_table, dst, src, size);
-}
-
 TF_BUILTIN(WasmAllocateArray, WasmBuiltinsAssembler) {
   TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
   TNode<Smi> map_index = CAST(Parameter(Descriptor::kMapIndex));

src/builtins/builtins-wasm-gen.h

@@ -27,9 +27,6 @@ class WasmBuiltinsAssembler : public CodeStubAssembler {
 
   TNode<FixedArray> LoadManagedObjectMapsFromInstance(
       TNode<WasmInstanceObject> instance);
-
- protected:
-  TNode<Smi> SmiFromUint32WithSaturation(TNode<Uint32T> value, uint32_t max);
 };
 
 }  // namespace internal

src/builtins/convert.tq

@@ -201,6 +201,9 @@ Convert<PositiveSmi, intptr>(i: intptr): PositiveSmi labels IfOverflow {
       goto IfOverflow;
     }
 }
+Convert<PositiveSmi, uint32>(ui: uint32): PositiveSmi labels IfOverflow {
+  return Convert<PositiveSmi>(Convert<uintptr>(ui)) otherwise IfOverflow;
+}
 Convert<int32, Smi>(s: Smi): int32 {
   return SmiToInt32(s);
 }

src/builtins/wasm.tq

@@ -7,6 +7,10 @@
 namespace runtime {
 extern runtime WasmMemoryGrow(Context, WasmInstanceObject, Smi): Smi;
 extern runtime WasmRefFunc(Context, WasmInstanceObject, Smi): JSAny;
+extern runtime WasmTableInit(
+    Context, WasmInstanceObject, Object, Object, Smi, Smi, Smi): JSAny;
+extern runtime WasmTableCopy(
+    Context, WasmInstanceObject, Object, Object, Smi, Smi, Smi): JSAny;
 extern runtime WasmFunctionTableGet(
     Context, WasmInstanceObject, Smi, Smi): JSAny;
 extern runtime WasmFunctionTableSet(
@@ -74,6 +78,38 @@ builtin WasmMemoryGrow(numPages: int32): int32 {
   return SmiToInt32(result);
 }
 
+builtin WasmTableInit(
+    dstRaw: uint32, srcRaw: uint32, sizeRaw: uint32, tableIndex: Smi,
+    segmentIndex: Smi): JSAny {
+  try {
+    const instance: WasmInstanceObject = LoadInstanceFromFrame();
+    const dst: Smi = Convert<PositiveSmi>(dstRaw) otherwise TableOutOfBounds;
+    const src: Smi = Convert<PositiveSmi>(srcRaw) otherwise TableOutOfBounds;
+    const size: Smi = Convert<PositiveSmi>(sizeRaw) otherwise TableOutOfBounds;
+    tail runtime::WasmTableInit(
+        LoadContextFromInstance(instance), instance, tableIndex, segmentIndex,
+        dst, src, size);
+  } label TableOutOfBounds deferred {
+    tail ThrowWasmTrapTableOutOfBounds();
+  }
+}
+
+builtin WasmTableCopy(
+    dstRaw: uint32, srcRaw: uint32, sizeRaw: uint32, dstTable: Smi,
+    srcTable: Smi): JSAny {
+  try {
+    const instance: WasmInstanceObject = LoadInstanceFromFrame();
+    const dst: Smi = Convert<PositiveSmi>(dstRaw) otherwise TableOutOfBounds;
+    const src: Smi = Convert<PositiveSmi>(srcRaw) otherwise TableOutOfBounds;
+    const size: Smi = Convert<PositiveSmi>(sizeRaw) otherwise TableOutOfBounds;
+    tail runtime::WasmTableCopy(
+        LoadContextFromInstance(instance), instance, dstTable, srcTable, dst,
+        src, size);
+  } label TableOutOfBounds deferred {
+    tail ThrowWasmTrapTableOutOfBounds();
+  }
+}
+
 builtin WasmTableGet(tableIndex: intptr, index: int32): Object {
   const instance: WasmInstanceObject = LoadInstanceFromFrame();
   const entryIndex: intptr = ChangeInt32ToIntPtr(index);

src/codegen/interface-descriptors.cc

@@ -391,18 +391,6 @@ void WasmFloat64ToNumberDescriptor::InitializePlatformSpecific(
 }
 #endif  // !V8_TARGET_ARCH_IA32
 
-void WasmTableInitDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  DefaultInitializePlatformSpecific(data,
-                                    kParameterCount - kStackArgumentsCount);
-}
-
-void WasmTableCopyDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  DefaultInitializePlatformSpecific(data,
-                                    kParameterCount - kStackArgumentsCount);
-}
-
 #if !defined(V8_TARGET_ARCH_MIPS) && !defined(V8_TARGET_ARCH_MIPS64)
 void WasmI32AtomicWait32Descriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {

src/codegen/interface-descriptors.h

@@ -103,8 +103,6 @@ namespace internal {
   V(WasmFloat64ToNumber)                 \
   V(WasmI32AtomicWait32)                 \
   V(WasmI64AtomicWait32)                 \
-  V(WasmTableInit)                       \
-  V(WasmTableCopy)                       \
   BUILTIN_LIST_TFS(V)                    \
   TORQUE_BUILTIN_LIST_TFC(V)
 
@@ -1384,52 +1382,6 @@ class WasmFloat64ToNumberDescriptor final : public CallInterfaceDescriptor {
   DECLARE_DESCRIPTOR(WasmFloat64ToNumberDescriptor, CallInterfaceDescriptor)
 };
 
-class WasmTableInitDescriptor final : public CallInterfaceDescriptor {
- public:
-  DEFINE_PARAMETERS_NO_CONTEXT(kDestination, kSource, kSize, kTableIndex,
-                               kSegmentIndex)
-  DEFINE_PARAMETER_TYPES(MachineType::Int32(),      // kDestination
-                         MachineType::Int32(),      // kSource
-                         MachineType::Int32(),      // kSize
-                         MachineType::AnyTagged(),  // kTableIndex
-                         MachineType::AnyTagged(),  // kSegmentindex
-  )
-
-#if V8_TARGET_ARCH_IA32
-  static constexpr bool kPassLastArgOnStack = true;
-#else
-  static constexpr bool kPassLastArgOnStack = false;
-#endif
-
-  // Pass the last parameter through the stack.
-  static constexpr int kStackArgumentsCount = kPassLastArgOnStack ? 1 : 0;
-
-  DECLARE_DESCRIPTOR(WasmTableInitDescriptor, CallInterfaceDescriptor)
-};
-
-class WasmTableCopyDescriptor final : public CallInterfaceDescriptor {
- public:
-  DEFINE_PARAMETERS_NO_CONTEXT(kDestination, kSource, kSize, kDestinationTable,
-                               kSourceTable)
-  DEFINE_PARAMETER_TYPES(MachineType::Int32(),      // kDestination
-                         MachineType::Int32(),      // kSource
-                         MachineType::Int32(),      // kSize
-                         MachineType::AnyTagged(),  // kDestinationTable
-                         MachineType::AnyTagged(),  // kSourceTable
-  )
-
-#if V8_TARGET_ARCH_IA32
-  static constexpr bool kPassLastArgOnStack = true;
-#else
-  static constexpr bool kPassLastArgOnStack = false;
-#endif
-
-  // Pass the last parameter through the stack.
-  static constexpr int kStackArgumentsCount = kPassLastArgOnStack ? 1 : 0;
-
-  DECLARE_DESCRIPTOR(WasmTableCopyDescriptor, CallInterfaceDescriptor)
-};
-
 class V8_EXPORT_PRIVATE I64ToBigIntDescriptor final
     : public CallInterfaceDescriptor {
  public:

src/runtime/runtime-wasm.cc

@@ -344,6 +344,9 @@ RUNTIME_FUNCTION(Runtime_WasmTableInit) {
   CONVERT_ARG_HANDLE_CHECKED(WasmInstanceObject, instance, 0);
   CONVERT_UINT32_ARG_CHECKED(table_index, 1);
   CONVERT_UINT32_ARG_CHECKED(elem_segment_index, 2);
+  static_assert(
+      wasm::kV8MaxWasmTableSize < kSmiMaxValue,
+      "Make sure clamping to Smi range doesn't make an invalid call valid");
   CONVERT_UINT32_ARG_CHECKED(dst, 3);
   CONVERT_UINT32_ARG_CHECKED(src, 4);
   CONVERT_UINT32_ARG_CHECKED(count, 5);
@@ -363,6 +366,9 @@ RUNTIME_FUNCTION(Runtime_WasmTableCopy) {
   CONVERT_ARG_HANDLE_CHECKED(WasmInstanceObject, instance, 0);
   CONVERT_UINT32_ARG_CHECKED(table_dst_index, 1);
   CONVERT_UINT32_ARG_CHECKED(table_src_index, 2);
+  static_assert(
+      wasm::kV8MaxWasmTableSize < kSmiMaxValue,
+      "Make sure clamping to Smi range doesn't make an invalid call valid");
   CONVERT_UINT32_ARG_CHECKED(dst, 3);
   CONVERT_UINT32_ARG_CHECKED(src, 4);
   CONVERT_UINT32_ARG_CHECKED(count, 5);