Cranelift ARM64 and Spidermonkey integration

[bnjbvr]

Trying to keep track of all the remaining correctness issues in the new arm64 backend, found when running Spidermonkey test cases. I'll update this list as I find and understand more issues.

cc @julian-seward1 @cfallin

• anyref / reftypes integration. This is a large item that will require additional support in regalloc.rs too.
• unpatched code locations should respect the emit_all_ones_funcaddrs setting (by putting all ones in unpatched code locations when this setting is set to true) => implement emit_all_ones_funcaddrs in new backend #1538
• integer SDiv/UDiv must be legalized to a sequence that checks if the divisor is 0 (or if we're dividing INT_MIN by -1), when the avoid_div_traps setting is set to true. => arm64: Implement checks in division / remainder #1585
• ditto for modulo => arm64: Implement checks in division / remainder #1585
• float-to-int conversion must raise errors in some cases (out of bounds, NaN, inf) => aarch64: implement correct float-to-int conversion semantics #1578
• (verify?) saturating conversions must return 0 for NaN
• rotate_left by an amount larger than the integer's size is allowed (apply modulo on rotation amount) => aarch64: mask rotation counts and share more codegen #1584
• there's something wrong when passing many FP/int registers on the stack (might be on the Spidermonkey side; to be investigated) => aarch64: correctly pass f32/f64 stack arguments in function calls #1564
• trapif (as legalized from trapnz) may not take its input from an ifcmp, it seems
• (verify?) popcnt is still incorrect for i32, see also Cranelift aarch64 backend: implement 8/16/32-bit popcnt more efficiently #1537
• lowering of stack store for call arguments is incorrect for large SP offsets => aarch64: emit SP copies when SP is involved in an explicit add during address lowering #1586

[github-actions]

Subscribe to Label Action

cc @bnjbvr

This issue or pull request has been labeled: "cranelift"

Thus the following users have been cc'd because of the following labels:

• bnjbvr: cranelift

To subscribe or unsubscribe from this label, edit the .github/subscribe-to-label.json configuration file.

Learn more.

[jgouly]

I'm working on a patch for the DIV by 0 and overflow issue.

[bnjbvr]

I'll take care of float-to-int conversions edge cases. edit: done in #1578

[cfallin]

I can take the trapif / ifcmp issue -- it's sort of a gnarly corner of isel. Also happy to fix rotate_left and the saturating conversions.

[bnjbvr]

I'm now looking at rotations. There are a few tricks we can steal from Spidermonkey's implementation... done => #1584

[bnjbvr]

Re trapif, investigation shows that a heap with explicit bounds checks will generate ifadd_cout to compute base+offset, then check for overflow with trapif if the carry flag is set. I'm happy to let others figure the right fix for this (this would require implementing ifadd_cout too, or lowering heap accesses with explicit bounds checks to something entirely different). Here's a test case extracted from Spidermonkey test suite.

function u0:0(i32, i64 vmctx) baldrdash_system_v {
    gv0 = vmctx
    gv1 = load.i64 notrap aligned gv0
    gv2 = load.i32 notrap aligned gv0+8
    heap0 = dynamic gv1, min 0x0001_0000, bound gv2, offset_guard 0xfff8, index_type i32

                                block0(v0: i32, v1: i64):
@0025                               v4 = load.i32 notrap aligned v1+8
@0025                               v5 = iconst.i32 0x7fff_ffe1
@0025                               v6, v7 = iadd_ifcout v0, v5
@0025                               trapif ult v7, heap_oob
@0025                               v8 = icmp ugt v6, v4
@0025                               brz v8, block3
@0025                               jump block2

                                block2:
@0025                               trap heap_oob

                                block3:
@0025                               v9 = uextend.i64 v0
@0025                               v10 = get_pinned_reg.i64 
@0025                               v2 = iadd v10, v9
@0025                               v3 = sload8.i32 v2+0x7fff_ffff
@002d                               jump block1

                                block1:
@002d                               fallthrough_return
}

[bnjbvr]

Confirmed that as of last Friday, Spidermonkey can run all the main tests, and only have the two remaining issues. I'll open up follow-up issues instead for both remaining items, because reftypes require a bunch of work in regalloc too, and heaps with explicit bounds checks is lower priority on arm64.

RESOLVED FIXED \o/