Bug 1328127: Fold br_table with all-same-successors into a goto in wasm; r=luke

MozReview-Commit-ID: 7DDNWYXKzSv

--HG--
extra : rebase_source : 7f84c6761bea7848bde119d1767ca0c56dba7c84

js/src/jit-test/tests/wasm/regress/brtable-conditionblock-folding.js

@@ -0,0 +1,19 @@
+load(libdir + "wasm.js");
+
+assertEq(wasmEvalText(`
+(module
+  (func $f (param $p i32)
+    block $out
+      i32.const 0
+      if
+        i32.const 1
+        tee_local $p
+        br_table $out $out
+      end
+    end
+    get_local $p
+    br_if 0
+  )
+  (export "f" $f)
+)
+`).exports.f(42), undefined);

js/src/wasm/WasmIonCompile.cpp

@@ -1830,23 +1830,35 @@ EmitBrTable(FunctionCompiler& f)
     if (!depths.reserve(tableLength))
         return false;
 
-    uint32_t depth;
     for (size_t i = 0; i < tableLength; ++i) {
+        uint32_t depth;
         if (!f.iter().readBrTableEntry(&type, &value, &depth))
             return false;
         depths.infallibleAppend(depth);
     }
 
     // Read the default label.
-    if (!f.iter().readBrTableDefault(&type, &value, &depth))
+    uint32_t defaultDepth;
+    if (!f.iter().readBrTableDefault(&type, &value, &defaultDepth))
         return false;
 
     MDefinition* maybeValue = IsVoid(type) ? nullptr : value;
 
-    if (tableLength == 0)
-        return f.br(depth, maybeValue);
+    // If all the targets are the same, or there are no targets, we can just
+    // use a goto. This is not just an optimization: MaybeFoldConditionBlock
+    // assumes that tables have more than one successor.
+    bool allSameDepth = true;
+    for (uint32_t depth : depths) {
+        if (depth != defaultDepth) {
+            allSameDepth = false;
+            break;
+        }
+    }
 
-    return f.brTable(index, depth, depths, maybeValue);
+    if (allSameDepth)
+        return f.br(defaultDepth, maybeValue);
+
+    return f.brTable(index, defaultDepth, depths, maybeValue);
 }
 
 static bool