[wasm][turboshaft] Support ref.cast in Wasm-in-JS body inlining [v8/v8 : main]

0 views
Skip to first unread message

Daniel Lehmann (Gerrit)

unread,
Apr 2, 2026, 4:05:10 PM (3 days ago) Apr 2
to Matthias Liedtke, V8 LUCI CQ, dmercadi...@chromium.org, v8-re...@googlegroups.com
Attention needed from Matthias Liedtke

Daniel Lehmann added 7 comments

Patchset-level comments
File-level comment, Patchset 2 (Latest):
Daniel Lehmann . resolved

Not quite one-shot in the end, but most edits went through some agent back and forth and certainly much quicker than I would've been able to...

File src/compiler/turboshaft/operations.h
Line 7456, Patchset 1: bool has_rtt;
Daniel Lehmann . unresolved

`WasmTypeCastOp` now has two optional arguments. The FrameState, depending on whether it's in the JS pipeline or the regular Wasm pipeline, and the RTT, depending on whether it's casting to an abstract heap type or not. Before, it used the input count to derive whether the RTT is present or not, but with two optional arguments, that's ambiguous now.

File src/compiler/turboshaft/wasm-in-js-inlining-reducer-inl.h
Line 1421, Patchset 1: to->op = from.op;
Daniel Lehmann . unresolved

Sometimes the FunctionBodyDecoder already optimizes casts "statically" to this.

Line 1135, Patchset 1: if (v8_flags.experimental_wasm_assume_ref_cast_succeeds) {
Daniel Lehmann . unresolved

Same here, basically a copy from the regular Wasm pipeline.

Line 1113, Patchset 1: if (target.is_shared() == SharedFlag::kYes) {
Daniel Lehmann . unresolved

Except for the bailout on shared types, and the added `frame_state_`, this is identical to the implementation in `turboshaft-graph-interface.cc`.

Line 1103, Patchset 1: V<FixedArray> managed_object_maps() {
Daniel Lehmann . unresolved

This helper is a bit useless, but this way the connection to the `turboshaft-graph-interface.cc` is more apparent.

File src/compiler/turboshaft/wasm-lowering-reducer.h
Line 1157, Patchset 1: const wasm::WasmModule* module() {
Daniel Lehmann . unresolved

Since the module is set during the `WasmInJSInliningReducer`, we cannot initialize the field too early. I don't think this is performance critical enough to warrant some kind of lazy initialized-on-first-access cache, but WDYT?

Open in Gerrit

Related details

Attention is currently required from:
  • Matthias Liedtke
Submit Requirements:
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: v8/v8
Gerrit-Branch: main
Gerrit-Change-Id: Ib36fb89c0c78547b64e42bc40e91b440688a9408
Gerrit-Change-Number: 7726046
Gerrit-PatchSet: 2
Gerrit-Owner: Daniel Lehmann <dleh...@chromium.org>
Gerrit-Reviewer: Daniel Lehmann <dleh...@chromium.org>
Gerrit-Reviewer: Matthias Liedtke <mlie...@chromium.org>
Gerrit-Attention: Matthias Liedtke <mlie...@chromium.org>
Gerrit-Comment-Date: Thu, 02 Apr 2026 20:05:05 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
unsatisfied_requirement
open
diffy
Reply all
Reply to author
Forward
0 new messages