Remove the TRAVERSE_CALLS option in the ConstantExpressionRunner (#6449)

The implementation of calls with this option was incorrect because it cleared
the locals before evaluating the call arguments. The likely explanation for why
this was never noticed is that there are no users of this option, especially
since it is exposed in the C and JS APIs but not used internally.

Rather than try to fix the implementation, just remove the option.

Author: tlively

CHANGELOG.md

@@ -22,6 +22,7 @@ Current Trunk
    to configure which features to enable in the parser.
  - The build-time option to use legacy WasmGC opcodes is removed.
  - The strings in `string.const` instructions must now be valid WTF-8.
+ - The `TraverseCalls` flag for `ExpressionRunner` is removed.
 
 v117
 ----

src/binaryen-c.cpp

@@ -6322,10 +6322,6 @@ ExpressionRunnerFlags ExpressionRunnerFlagsPreserveSideeffects() {
   return CExpressionRunner::FlagValues::PRESERVE_SIDEEFFECTS;
 }
 
-ExpressionRunnerFlags ExpressionRunnerFlagsTraverseCalls() {
-  return CExpressionRunner::FlagValues::TRAVERSE_CALLS;
-}
-
 ExpressionRunnerRef ExpressionRunnerCreate(BinaryenModuleRef module,
                                            ExpressionRunnerFlags flags,
                                            BinaryenIndex maxDepth,

src/binaryen-c.h

@@ -3495,12 +3495,6 @@ BINARYEN_API ExpressionRunnerFlags ExpressionRunnerFlagsDefault();
 // so subsequent code keeps functioning.
 BINARYEN_API ExpressionRunnerFlags ExpressionRunnerFlagsPreserveSideeffects();
 
-// Traverse through function calls, attempting to compute their concrete value.
-// Must not be used in function-parallel scenarios, where the called function
-// might be concurrently modified, leading to undefined behavior. Traversing
-// another function reuses all of this runner's flags.
-BINARYEN_API ExpressionRunnerFlags ExpressionRunnerFlagsTraverseCalls();
-
 // Creates an ExpressionRunner instance
 BINARYEN_API ExpressionRunnerRef
 ExpressionRunnerCreate(BinaryenModuleRef module,

src/js/binaryen.js-post.js

@@ -638,7 +638,6 @@ function initializeConstants() {
   Module['ExpressionRunner']['Flags'] = {
     'Default': Module['_ExpressionRunnerFlagsDefault'](),
     'PreserveSideeffects': Module['_ExpressionRunnerFlagsPreserveSideeffects'](),
-    'TraverseCalls': Module['_ExpressionRunnerFlagsTraverseCalls']()
   };
 }
 

src/wasm-interpreter.h

@@ -2211,10 +2211,6 @@ class ConstantExpressionRunner : public ExpressionRunner<SubType> {
     // the expression if it also sets a local, which must be preserved in this
     // scenario so subsequent code keeps functioning.
     PRESERVE_SIDEEFFECTS = 1 << 0,
-    // Traverse through function calls, attempting to compute their concrete
-    // value. Must not be used in function-parallel scenarios, where the called
-    // function might be concurrently modified, leading to undefined behavior.
-    TRAVERSE_CALLS = 1 << 1
   };
 
   // Flags indicating special requirements, for example whether we are just
@@ -2322,35 +2318,6 @@ class ConstantExpressionRunner : public ExpressionRunner<SubType> {
   Flow visitCall(Call* curr) {
     NOTE_ENTER("Call");
     NOTE_NAME(curr->target);
-    // Traverse into functions using the same mode, which we can also do
-    // when replacing as long as the function does not have any side effects.
-    // Might yield something useful for simple functions like `clamp`, sometimes
-    // even if arguments are only partially constant or not constant at all.
-    if ((flags & FlagValues::TRAVERSE_CALLS) != 0 && this->module != nullptr) {
-      auto* func = this->module->getFunction(curr->target);
-      if (!func->imported()) {
-        if (func->getResults().isConcrete()) {
-          auto numOperands = curr->operands.size();
-          assert(numOperands == func->getNumParams());
-          auto prevLocalValues = localValues;
-          localValues.clear();
-          for (Index i = 0; i < numOperands; ++i) {
-            auto argFlow = ExpressionRunner<SubType>::visit(curr->operands[i]);
-            if (!argFlow.breaking()) {
-              assert(argFlow.values.isConcrete());
-              localValues[i] = argFlow.values;
-            }
-          }
-          auto retFlow = ExpressionRunner<SubType>::visit(func->body);
-          localValues = prevLocalValues;
-          if (retFlow.breakTo == RETURN_FLOW) {
-            return Flow(retFlow.values);
-          } else if (!retFlow.breaking()) {
-            return retFlow;
-          }
-        }
-      }
-    }
     return Flow(NONCONSTANT_FLOW);
   }
   Flow visitCallIndirect(CallIndirect* curr) {

test/binaryen.js/expressionrunner.js

@@ -1,7 +1,6 @@
 var Flags = binaryen.ExpressionRunner.Flags;
 console.log("// ExpressionRunner.Flags.Default = " + Flags.Default);
 console.log("// ExpressionRunner.Flags.PreserveSideeffects = " + Flags.PreserveSideeffects);
-console.log("// ExpressionRunner.Flags.TraverseCalls = " + Flags.TraverseCalls);
 
 function assertDeepEqual(x, y) {
   if (typeof x === "object") {
@@ -139,39 +138,7 @@ assertDeepEqual(
   }
 );
 
-// Should traverse into (simple) functions if requested
-runner = new binaryen.ExpressionRunner(module, Flags.TraverseCalls);
-module.addFunction("add", binaryen.createType([ binaryen.i32, binaryen.i32 ]), binaryen.i32, [],
-  module.block(null, [
-    module.i32.add(
-      module.local.get(0, binaryen.i32),
-      module.local.get(1, binaryen.i32)
-    )
-  ], binaryen.i32)
-);
-assert(runner.setLocalValue(0, module.i32.const(1)));
-expr = runner.runAndDispose(
-  module.i32.add(
-    module.i32.add(
-      module.local.get(0, binaryen.i32),
-      module.call("add", [
-        module.i32.const(2),
-        module.i32.const(4)
-      ], binaryen.i32)
-    ),
-    module.local.get(0, binaryen.i32)
-  )
-);
-assertDeepEqual(
-  binaryen.getExpressionInfo(expr),
-  {
-    id: binaryen.ExpressionIds.Const,
-    type: binaryen.i32,
-    value: 8
-  }
-);
-
-// Should not attempt to traverse into functions if not explicitly set
+// Should not attempt to traverse into functions
 runner = new binaryen.ExpressionRunner(module);
 expr = runner.runAndDispose(
   module.i32.add(

test/binaryen.js/expressionrunner.js.txt

@@ -1,3 +1,2 @@
 // ExpressionRunner.Flags.Default = 0
 // ExpressionRunner.Flags.PreserveSideeffects = 1
-// ExpressionRunner.Flags.TraverseCalls = 2