Use exactness to optimize GUFA cone depth (#7582)

Exact references are known to point to exactly their heap type and not
one of its subtypes. GUFA already analyzed exactness via the more
general "cone" types that include an allowed subtyping depth. Exact
types are equivalent to cone types of depth zero. Let GUFA take
advantage of exactness information by normalizing cone depths to 0
whenever the cone type is exact.

Author: tlively

src/ir/possible-contents.cpp

@@ -144,7 +144,9 @@ PossibleContents PossibleContents::combine(const PossibleContents& a,
 
 void PossibleContents::intersect(const PossibleContents& other) {
   // This does not yet handle all possible content.
-  assert(other.isFullConeType() || other.isLiteral() || other.isNone());
+  assert((other.isConeType() &&
+          (other.getType().isExact() || other.hasFullCone())) ||
+         other.isLiteral() || other.isNone());
 
   if (*this == other) {
     // Nothing changes.
@@ -201,6 +203,7 @@ void PossibleContents::intersect(const PossibleContents& other) {
   // The heap types are compatible, so intersect the cones.
   auto depthFromRoot = heapType.getDepth();
   auto otherDepthFromRoot = otherHeapType.getDepth();
+  auto newDepthFromRoot = newType.getHeapType().getDepth();
 
   // Note the global's information, if we started as a global. In that case, the
   // code below will refine our type but we can remain a global, which we will
@@ -210,38 +213,21 @@ void PossibleContents::intersect(const PossibleContents& other) {
     globalName = getGlobal();
   }
 
-  // By assumption |other| has full depth. Consider the other cone in |this|.
-  if (hasFullCone()) {
+  if (hasFullCone() && other.hasFullCone()) {
     // Both are full cones, so the result is as well.
-    value = FullConeType(newType);
+    value = DefaultConeType(newType);
   } else {
-    // The result is a partial cone. If the cone starts in |otherHeapType| then
-    // we need to adjust the depth down, since it will be smaller than the
-    // original cone:
-    /*
-    //                             ..
-    //                            /
-    //              otherHeapType
-    //            /               \
-    //   heapType                  ..
-    //            \
-    */
-    // E.g. if |this| is a cone of depth 10, and |otherHeapType| is an immediate
-    // subtype of |this|, then the new cone must be of depth 9.
-    auto newDepth = getCone().depth;
-    if (newType.getHeapType() == otherHeapType) {
-      assert(depthFromRoot <= otherDepthFromRoot);
-      auto reduction = otherDepthFromRoot - depthFromRoot;
-      if (reduction > newDepth) {
-        // The cone on heapType does not even reach the cone on otherHeapType,
-        // so the result is not a cone.
-        setNoneOrNull();
-        return;
-      }
-      newDepth -= reduction;
+    // The result is a partial cone. Check whether the cones overlap, and if
+    // they do, find the new depth.
+    if (newDepthFromRoot - depthFromRoot > getCone().depth ||
+        newDepthFromRoot - otherDepthFromRoot > other.getCone().depth) {
+      setNoneOrNull();
+      return;
     }
-
-    value = ConeType{newType, newDepth};
+    Index newDepth = getCone().depth - (newDepthFromRoot - depthFromRoot);
+    Index otherNewDepth =
+      other.getCone().depth - (newDepthFromRoot - otherDepthFromRoot);
+    value = ConeType{newType, std::min(newDepth, otherNewDepth)};
   }
 
   if (globalName) {
@@ -371,7 +357,19 @@ bool PossibleContents::isSubContents(const PossibleContents& a,
     return false;
   }
 
-  WASM_UNREACHABLE("unhandled case of isSubContents");
+  if (b.isGlobal()) {
+    // We've already ruled out anything but another global or non-full cone type
+    // for a.
+    return false;
+  }
+
+  assert(b.isConeType() && (a.isConeType() || a.isGlobal()));
+  if (!Type::isSubType(a.getType(), b.getType())) {
+    return false;
+  }
+  // Check that a's cone type is enclosed in b's cone type.
+  return a.getType().getHeapType().getDepth() + a.getCone().depth <=
+         b.getType().getHeapType().getDepth() + b.getCone().depth;
 }
 
 namespace {
@@ -1463,7 +1461,7 @@ class TNHOracle : public ModuleUtils::ParallelFunctionAnalysis<TNHInfo> {
 
   // Get the type we inferred was possible at a location.
   PossibleContents getContents(Expression* curr) {
-    auto naiveContents = PossibleContents::fullConeType(curr->type);
+    auto naiveContents = PossibleContents::coneType(curr->type);
 
     // If we inferred nothing, use the naive type.
     auto iter = inferences.find(curr);
@@ -1871,8 +1869,8 @@ void TNHOracle::optimizeCallCasts(Expression* call,
         // There are two constraints on this location: any value there must
         // be of the declared type (curr->type) and also the cast type, so
         // we know only their intersection can appear here.
-        auto declared = PossibleContents::fullConeType(curr->type);
-        auto intersection = PossibleContents::fullConeType(castType);
+        auto declared = PossibleContents::coneType(curr->type);
+        auto intersection = PossibleContents::coneType(castType);
         intersection.intersect(declared);
         if (intersection.isConeType()) {
           auto intersectionType = intersection.getType();
@@ -1956,7 +1954,7 @@ struct Flower {
   PossibleContents getTNHContents(Expression* curr) {
     if (!tnhOracle) {
       // No oracle; just use the type in the IR.
-      return PossibleContents::fullConeType(curr->type);
+      return PossibleContents::coneType(curr->type);
     }
     return tnhOracle->getContents(curr);
   }
@@ -2858,7 +2856,7 @@ void Flower::readFromData(Type declaredType,
 #ifndef NDEBUG
   // We must not have anything in the reference that is invalid for the wasm
   // type there.
-  auto maximalContents = PossibleContents::fullConeType(declaredType);
+  auto maximalContents = PossibleContents::coneType(declaredType);
   assert(PossibleContents::isSubContents(refContents, maximalContents));
 #endif
 
@@ -2953,7 +2951,7 @@ void Flower::writeToData(Expression* ref, Expression* value, Index fieldIndex) {
 #ifndef NDEBUG
   // We must not have anything in the reference that is invalid for the wasm
   // type there.
-  auto maximalContents = PossibleContents::fullConeType(ref->type);
+  auto maximalContents = PossibleContents::coneType(ref->type);
   assert(PossibleContents::isSubContents(refContents, maximalContents));
 #endif
 

src/ir/possible-contents.h

@@ -126,9 +126,12 @@ class PossibleContents {
 
   static constexpr Index FullDepth = -1;
 
-  // Internal convenience for creating a cone type of unbounded depth, i.e., the
-  // full cone of all subtypes for that type.
-  static ConeType FullConeType(Type type) { return ConeType{type, FullDepth}; }
+  // Internal convenience for creating a cone type carrying no information
+  // besides the type. For exact references, the depth is 0 and for all other
+  // types the depth is unbounded and includes all possible subtypes.
+  static ConeType DefaultConeType(Type type) {
+    return type.isExact() ? ExactType(type) : ConeType{type, FullDepth};
+  }
 
   template<typename T> PossibleContents(T value) : value(value) {}
 
@@ -148,10 +151,11 @@ class PossibleContents {
   static PossibleContents exactType(Type type) {
     return PossibleContents{ExactType(type)};
   }
-  // Helper for a cone with unbounded depth, i.e., the full cone of all subtypes
-  // for that type.
-  static PossibleContents fullConeType(Type type) {
-    return PossibleContents{FullConeType(type)};
+  // Helper for a cone with default depth for the given type. For exact
+  // references this is depth 0 and for all other this tyis is unbounded depth
+  // and includes all possible subtypes.
+  static PossibleContents coneType(Type type) {
+    return PossibleContents{DefaultConeType(type)};
   }
   static PossibleContents coneType(Type type, Index depth) {
     return PossibleContents{ConeType{type, depth}};
@@ -165,7 +169,7 @@ class PossibleContents {
 
     if (type.isRef()) {
       // For a reference, subtyping matters.
-      return fullConeType(type);
+      return coneType(type);
     }
 
     if (type == Type::unreachable) {
@@ -251,7 +255,7 @@ class PossibleContents {
     if (auto* literal = std::get_if<Literal>(&value)) {
       return ExactType(literal->type);
     } else if (auto* global = std::get_if<GlobalInfo>(&value)) {
-      return FullConeType(global->type);
+      return DefaultConeType(global->type);
     } else if (auto* coneType = std::get_if<ConeType>(&value)) {
       return *coneType;
     } else if (std::get_if<None>(&value)) {
@@ -333,7 +337,7 @@ class PossibleContents {
       // the separate items in the tuple (tuples themselves have no subtyping,
       // so the tuple's depth must be 0, i.e., an exact type).
       assert(cone->depth == 0);
-      return fullConeType(type[i]);
+      return coneType(type[i]);
     } else {
       WASM_UNREACHABLE("not a tuple");
     }

src/passes/GUFA.cpp

@@ -246,7 +246,7 @@ struct GUFAOptimizer
       // We have some knowledge of the type here. Use that to optimize: RefTest
       // returns 1 if the input is of a subtype of the intended type, that is,
       // we are looking for a type in that cone of types.
-      auto intendedContents = PossibleContents::fullConeType(curr->castType);
+      auto intendedContents = PossibleContents::coneType(curr->castType);
 
       auto optimize = [&](int32_t result) {
         auto* last = Builder(*getModule()).makeConst(Literal(int32_t(result)));