Allow Asm.js type coercions on simd builtin ret values

lib/Runtime/Language/AsmJsByteCodeGenerator.cpp

@@ -913,11 +913,50 @@ namespace Js
         mWriter.AsmBr( mFunction->GetFuncInfo()->singleExit );
         return emitInfo;
     }
+
     bool AsmJSByteCodeGenerator::IsFRound(AsmJsMathFunction* sym)
     {
         return (sym && sym->GetMathBuiltInFunction() == AsmJSMathBuiltin_fround);
     }
 
+    bool AsmJSByteCodeGenerator::IsValidSimdFcnRetType(AsmJsSIMDFunction& simdFunction, const AsmJsRetType& expectedType, const AsmJsRetType& retType)
+    {
+        // Return types of simd builtins can be coereced to other asmjs types when a valid coercion exists
+        // e.g.
+        //     float    -> double           var d = 0.0; d = +float32x4ExtractLane(...)
+        //     signed   -> double           var d = 0.0; d = +int32x4ExtractLane(...)
+        //     unsigned -> double           var d = 0.0; d = +uint32x4ExtractLane(...)
+
+        // If a simd built-in is used without coercion, then expectedType is Void.
+        // All SIMD ops are allowed without coercion except a few that return bool. E.g. b4anyTrue()
+        // Unsigned and Bools are represented as Signed in AsmJs
+        if (expectedType == AsmJsRetType::Void)
+        {
+            return true;
+        }
+        else if (expectedType == retType)
+        {
+            Assert(expectedType == AsmJsRetType::Float   ||
+                   expectedType == AsmJsRetType::Signed  ||
+                   expectedType == AsmJsRetType::Unsigned||
+                   expectedType.toType().isSIMDType() );
+            return true;
+        }
+        else if (expectedType == AsmJsRetType::Double)
+        {
+            return (retType == AsmJsRetType::Float  ||
+                    retType == AsmJsRetType::Signed ||
+                    retType == AsmJsRetType::Unsigned);
+        }
+        else if (expectedType == AsmJsRetType::Signed)
+        {
+            //Unsigned and Bools are represented as Signed in AsmJs
+            return (retType == AsmJsRetType::Unsigned ||
+                    simdFunction.ReturnsBool());
+        }
+        return false;
+    }
+
     // First set of opcode are for External calls, second set is for internal calls
     static const OpCodeAsmJs callOpCode[2][7] =
     {
@@ -1642,12 +1681,7 @@ namespace Js
             throw AsmJsCompilationException(_u("SIMD builtin function doesn't support arguments"));
         }
 
-        // If a simd built-in is used without coercion, then expectedType is Void
-        // All SIMD ops are allowed without coercion except a few that return bool. E.g. b4anyTrue()
-        if ( 
-             (simdFunction->ReturnsBool() && expectedType != AsmJsRetType::Signed) ||
-             (expectedType != AsmJsRetType::Void && retType != expectedType)
-           )
+        if (!IsValidSimdFcnRetType(*simdFunction, expectedType, retType))
         {
             throw AsmJsCompilationException(_u("SIMD builtin function returns wrong type"));
         }

lib/Runtime/Language/AsmJsByteCodeGenerator.h

@@ -137,6 +137,7 @@ namespace Js
         void LoadSimd(RegSlot dst, RegSlot src, AsmJsVarType type);
 
         bool IsFRound(AsmJsMathFunction* sym);
+        bool IsValidSimdFcnRetType(AsmJsSIMDFunction& simdFunction, const AsmJsRetType& expectedType, const AsmJsRetType& retType);
         /// TODO:: Finish removing references to old bytecode generator
         ByteCodeGenerator* GetOldByteCodeGenerator() const
         {

test/SIMD.bool16x8.asmjs/rlexe.xml

@@ -101,4 +101,12 @@
       <compile-flags>-bgjit- -simdjs -simd128typespec -asmjs- -off:simplejit -mic:1</compile-flags>
     </default>
   </test>
+  <test>
+     <default>
+        <files>testBug1.js</files>
+        <baseline>testBug1.baseline</baseline>
+        <tags>exclude_dynapogo,exclude_ship</tags>
+        <compile-flags>-off:deferparse -testtrace:asmjs -simdjs -bgjit- -maic:1</compile-flags>
+     </default>
+   </test>
 </regress-exe>

test/SIMD.bool16x8.asmjs/testBug1.baseline

@@ -0,0 +1,6 @@
+
+testBug1.js(11, 5)
+	Asm.js Compilation Error function : asmModule::testBug
+	SIMD builtin function returns wrong type
+
+Asm.js compilation failed.

test/SIMD.bool16x8.asmjs/testBug1.js

@@ -0,0 +1,21 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft Corporation and contributors. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+function asmModule(stdlib, imports) {
+    "use asm";
+
+    var b8 = stdlib.SIMD.Bool16x8;
+    var b8extractLane = b8.extractLane;
+    var fround = stdlib.Math.fround;
+    function testBug()
+    {
+        var a = b8(1, 0, 1, 0, 1, 0, 1, 0);
+        var result = fround(0);
+        result = fround(b8extractLane(a,0));
+        return;
+    }
+    return {testBug:testBug};
+}
+
+var m = asmModule(this, {g1:SIMD.Bool16x8(1, 1, 1, 1, 1, 1, 1, 1)});

test/SIMD.bool16x8.asmjs/testConstructor.js

@@ -84,6 +84,13 @@ function asmModule(stdlib, imports) {
         return b8check(result);
     }
 
+    //Validation will fail with the bug
+    function retValueCoercionBug()
+    {
+        var ret1 = 0;
+        var a = b8(1,2,3,4,5,6,7,8);
+        ret1 = (b8extractLane(a, 0))|0;
+    }
     return {testConstructor:testConstructor,
     testSplat:testSplat,
     testLaneAccess: testLaneAccess};

test/SIMD.bool32x4.asmjs/rlexe.xml

@@ -101,4 +101,12 @@
       <compile-flags>-bgjit- -simdjs -simd128typespec -asmjs- -off:simplejit -mic:1</compile-flags>
     </default>
   </test>
+  <test>
+     <default>
+        <files>testBug1.js</files>
+        <baseline>testBug1.baseline</baseline>
+        <tags>exclude_dynapogo,exclude_ship</tags>
+        <compile-flags>-off:deferparse -testtrace:asmjs -simdjs -bgjit- -maic:1</compile-flags>
+     </default>
+   </test>
 </regress-exe>

test/SIMD.bool32x4.asmjs/testBug1.baseline

@@ -0,0 +1,6 @@
+
+testBug1.js(11, 5)
+	Asm.js Compilation Error function : asmModule::testBug
+	SIMD builtin function returns wrong type
+
+Asm.js compilation failed.

test/SIMD.bool32x4.asmjs/testBug1.js

@@ -0,0 +1,21 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft Corporation and contributors. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+function asmModule(stdlib, imports) {
+    "use asm";
+
+    var b = stdlib.SIMD.Bool32x4;
+    var bextractLane = b.extractLane;
+    var fround = stdlib.Math.fround;
+    function testBug()
+    {
+        var a = b(1, 0, 1, 0);
+        var result = fround(0);
+        result = fround(bextractLane(a,0));
+        return;
+    }
+    return {testBug:testBug};
+}
+
+var m = asmModule(this, {g1:SIMD.Bool16x8(1, 1, 1, 1, 1, 1, 1, 1)});

test/SIMD.bool32x4.asmjs/testConstructor.js

@@ -73,6 +73,14 @@ function asmModule(stdlib, imports) {
         return b4check(result);
     }
 
+    //Validation will fail with the bug
+    function retValueCoercionBug()
+    {
+        var ret1 = 0;
+        var a = b4(1,2,3,4);
+        ret1 = (b4extractLane(a, 0))|0;
+    }
+
     return {testConstructor:testConstructor,
     testSplat:testSplat,
     testLaneAccess: testLaneAccess};

test/SIMD.bool32x4.asmjs/testNeg1.js

@@ -0,0 +1,20 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft Corporation and contributors. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+function asmModule(stdlib, imports) {
+    "use asm";
+
+    var b8 = stdlib.SIMD.Bool16x8;
+    var b8extractLane = b8.extractLane;
+    function testNeg()
+    {
+        var a = b8(1, 0, 1, 0, 1, 0, 1, 0);
+        var result = 0.0;
+        result = +(b8extractLane(a,0));
+        return;
+    }
+    return {testNeg:testNeg};
+}
+
+var m = asmModule(this, {g1:SIMD.Bool16x8(1, 1, 1, 1, 1, 1, 1, 1)});

test/SIMD.bool8x16.asmjs/rlexe.xml

@@ -125,5 +125,13 @@
       <tags>exclude_dynapogo,exclude_ship</tags>
       <compile-flags>-bgjit- -asmjs -testtrace:asmjs -simdjs -AsmJsStopOnError -maic:0 -mic:0</compile-flags>
     </default>
-  </test>  
+  </test>
+    <test>
+     <default>
+        <files>testBug1.js</files>
+        <baseline>testBug1.baseline</baseline>
+        <tags>exclude_dynapogo,exclude_ship</tags>
+        <compile-flags>-off:deferparse -testtrace:asmjs -simdjs -bgjit- -maic:1</compile-flags>
+     </default>
+   </test>
 </regress-exe>

test/SIMD.bool8x16.asmjs/testBug1.baseline

@@ -0,0 +1,6 @@
+
+testBug1.js(11, 5)
+	Asm.js Compilation Error function : asmModule::testBug
+	SIMD builtin function returns wrong type
+
+Asm.js compilation failed.

test/SIMD.bool8x16.asmjs/testBug1.js

@@ -0,0 +1,21 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft Corporation and contributors. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+function asmModule(stdlib, imports) {
+    "use asm";
+
+    var b = stdlib.SIMD.Bool8x16;
+    var bextractLane = b.extractLane;
+    var fround = stdlib.Math.fround;
+    function testBug()
+    {
+        var a = b(1, 0, 1, 0,1, 0, 1, 0,1, 0, 1, 0,1, 0, 1, 0);
+        var result = fround(0);
+        result = fround(bextractLane(a,0));
+        return;
+    }
+    return {testBug:testBug};
+}
+
+var m = asmModule(this, {g1:SIMD.Bool16x8(1, 1, 1, 1, 1, 1, 1, 1)});

test/SIMD.bool8x16.asmjs/testConstructor.js

@@ -109,6 +109,14 @@ function asmModule(stdlib, imports) {
         return b16check(result);
     }
 
+    //Validation will fail with the bug
+    function retValueCoercionBug()
+    {
+        var ret1 = 0;
+        var a = b16(1,2,3,4,5,6,7,8,1,2,3,4,5,6,7,8);
+        ret1 = (b16extractLane(a, 0))|0;
+    }
+
     return {testConstructor:testConstructor,
     testSplat:testSplat,
     testLaneAccess: testLaneAccess};

test/SIMD.float32x4.asmjs/rlexe.xml

@@ -942,4 +942,12 @@
             <compile-flags>-bgjit- -simdjs -simd128typespec -asmjs- -off:simplejit -mic:1</compile-flags>
         </default>
     </test>
+    <test>
+     <default>
+        <files>testBug1.js</files>
+        <baseline>testBug1.baseline</baseline>
+        <tags>exclude_dynapogo,exclude_ship</tags>
+        <compile-flags>-off:deferparse -testtrace:asmjs -simdjs -bgjit- -maic:1</compile-flags>
+     </default>
+   </test>
 </regress-exe>

test/SIMD.float32x4.asmjs/testBug1.baseline

@@ -0,0 +1,6 @@
+
+testBug1.js(11, 5)
+	Asm.js Compilation Error function : asmModule::testBug
+	SIMD builtin function returns wrong type
+
+Asm.js compilation failed.

test/SIMD.float32x4.asmjs/testBug1.js

@@ -0,0 +1,21 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft Corporation and contributors. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+function asmModule(stdlib, imports) {
+    "use asm";
+
+    var b = stdlib.SIMD.Float32x4;
+    var bextractLane = b.extractLane;
+    var fround = stdlib.Math.fround;
+    function testBug()
+    {
+        var a = b(1.0, 0.0, 1.0, 0.0);
+        var result = 0;
+        result = bextractLane(a,0)|0;
+        return;
+    }
+    return {testBug:testBug};
+}
+
+var m = asmModule(this, {g1:SIMD.Bool16x8(1, 1, 1, 1, 1, 1, 1, 1)});

test/SIMD.float32x4.asmjs/testCalls.js

@@ -53,7 +53,7 @@ function asmModule(stdlib, imports) {
     var f4xor = f4.xor;
     var f4not = f4.not;
 
-
+    var f4extractLane = f4.extractLane;
 
     var fround = stdlib.Math.fround;
 
@@ -187,6 +187,16 @@ function asmModule(stdlib, imports) {
         return i4check(k);
     }
 
+    //Validation will fail with the bug
+    function retValueCoercionBug()
+    {
+        var ret = 0.0;
+        var ret1 = fround(0);
+        var a = f4(1.0, 2.0, 3.0, 4.0);
+        ret = +f4extractLane(a, 0);
+        ret1 = fround(f4extractLane(a, 0));
+    }
+
     return {func1:func1, func2:func2, func3:func3, func4:func4, fcBug1:fcBug_1, fcBug2:fcBug_2};
 }
 

test/SIMD.int16x8.asmjs/rlexe.xml

@@ -742,5 +742,12 @@
       <compile-flags>-bgjit- -simdjs -simd128typespec -asmjs- -off:simplejit -mic:1</compile-flags>
   </default>
   </test>  
-
+  <test>
+     <default>
+        <files>testBug1.js</files>
+        <baseline>testBug1.baseline</baseline>
+        <tags>exclude_dynapogo,exclude_ship</tags>
+        <compile-flags>-off:deferparse -testtrace:asmjs -simdjs -bgjit- -maic:1</compile-flags>
+     </default>
+   </test>
 </regress-exe>

test/SIMD.int16x8.asmjs/testBug1.baseline

@@ -0,0 +1,6 @@
+
+testBug1.js(11, 5)
+	Asm.js Compilation Error function : asmModule::testBug
+	SIMD builtin function returns wrong type
+
+Asm.js compilation failed.

test/SIMD.int16x8.asmjs/testBug1.js

@@ -0,0 +1,21 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft Corporation and contributors. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+function asmModule(stdlib, imports) {
+    "use asm";
+
+    var b8 = stdlib.SIMD.Int16x8;
+    var b8extractLane = b8.extractLane;
+    var fround = stdlib.Math.fround;
+    function testBug()
+    {
+        var a = b8(1, 0, 1, 0, 1, 0, 1, 0);
+        var result = fround(0);
+        result = fround(b8extractLane(a,0));
+        return;
+    }
+    return {testBug:testBug};
+}
+
+var m = asmModule(this, {g1:SIMD.Bool16x8(1, 1, 1, 1, 1, 1, 1, 1)});