Use effects for indirect call expressions by stevenfontanella · Pull Request #8625 · WebAssembly/binaryen

stevenfontanella · 2026-04-19T08:51:38Z

Part of #8615. After #8609, we compute effects for indirect call expressions, but only reflect this in the call-site via the effects of the Function that contains the indirect call. That let us reason about effects only one layer of indirection away, for example in the following module:

(func $a
  (call_ref $t (...))
)

(func $b
  (call $a)
)

If we know that an indirect call to $t can't possibly have any effects (e.g. its only potential target is a nop), we'd be able to optimize away (call $a) but not the (call_ref) itself, since the effects only got stored in the effects of $a.

This PR lets us reason about indirect call effects at the expression level within function bodies by adding a map from HeapType to effects typeEffects in wasm::Module. As a result we can completely optimize out the call_ref in the above example.

Drive-by fixes:

Set an unconditional trap effect on call_indirect when the call type doesn't match the target table.
Correctly set branchesOut for return_call on call.without.effects. Previously this would not have a branchesOut effect which may have allowed incorrect reorderings (we shouldn't move an effectful expression above a return_call but we would have allowed this). Will follow up in return_call with call.without.effects optimizes incorrectly #8693.

stevenfontanella · 2026-04-23T23:17:06Z

Seems like JJ + Github don't play well when I'm on a branch based on another branch that had a merge commit. Will fix this after merging the other branch.

When running in --closed-world, compute effects for indirect calls by unioning the effects of all potential functions of that type. In --closed-world, we assume that all references originate in our module, so the only possible functions that we don't know about are imports. Previously [we gave up on effects analysis](https://github.com/WebAssembly/binaryen/blob/29b2d42e8a748fbe1095696d58a52b7bf83e2253/src/passes/GlobalEffects.cpp#L83-L87) for indirect calls. Yields a very small byte count reduction in calcworker (3799354 - 3799297 = 57 bytes). Also shows no significant difference in Binaryen runtime: (0.1346069 -> 0.13375045 = <1% improvement, probably within noise). We expect more benefits after we're able to share indirect call effects with other passes, since currently they're only seen one layer up for callers of functions that indirectly call functions (see the newly-added tests for examples). Followups: * Share effect information per type with other passes besides just via Function::effects (#8625) * Exclude functions that don't have an address (i.e. functions that aren't the target of ref.func) from effect analysis () * Compute effects more precisely for exact + nullable/non-nullable references Part of #8615.

Gemini WIP Try changing call effects

aheejin · 2026-05-13T22:41:06Z

+  // When types are rewritten globally, the target type inherits the effects of
+  // source type (see type-updating.cpp). If the type of just one function is
+  // rewritten, we don't update this, because such a rewrite is only valid
+  // if the function is not the target of an indirect call (otherwise the
+  // indirect call would have to be rewritten too).


This paragraph can maybe move to type-updating.cpp?

Alon suggested documenting it here: #8625 (comment)

There is a similar comment in type-updating.cpp:

// Update indirect call effects per type. // When A is rewritten to B, B inherits the effects of A and A loses its // effects.

The part about individual functions being rewritten isn't relevant there since type-updating.cpp is for global type updates. Let me know if I should add anything else to make it more clear.

aheejin · 2026-05-13T22:44:36Z

@@ -1320,16 +1325,18 @@ class EffectAnalyzer {
      }
    }


Can't we just blindly merge funcEffects here and deal with exception and tryDepth and isReturn stuff at the end of addCallEffects once and for all? (In this case we may not need addCallEffectsFromGlobalEffects as a separate function after all)

That's how the code was written before but I found it hard to follow with the two different cases interleaved. I prefer to expand it into the two cases where we have and don't have global effects. If you want to compare:

binaryen/src/ir/effects.h

Lines 718 to 771 in 2f1f55a

void visitCall(Call* curr) {

// call.without.effects has no effects.

if (Intrinsics(parent.module).isCallWithoutEffects(curr)) {

return;

}

// Get the target's effects, if they exist. Note that we must handle the

// case of the function not yet existing (we may be executed in the middle

// of a pass, which may have built up calls but not the targets of those

// calls; in such a case, we do not find the targets and therefore assume

// we know nothing about the effects, which is safe).

const EffectAnalyzer* targetEffects = nullptr;

if (auto* target = parent.module.getFunctionOrNull(curr->target)) {

targetEffects = target->effects.get();

}

if (curr->isReturn) {

parent.branchesOut = true;

// When EH is enabled, any call can throw.

if (parent.features.hasExceptionHandling() &&

(!targetEffects || targetEffects->throws())) {

parent.hasReturnCallThrow = true;

}

}

if (targetEffects) {

// We have effect information for this call target, and can just use

// that. The one change we may want to make is to remove throws_, if the

// target function throws and we know that will be caught anyhow, the

// same as the code below for the general path. We can always filter out

// throws for return calls because they are already more precisely

// captured by `branchesOut`, which models the return, and

// `hasReturnCallThrow`, which models the throw that will happen after

// the return.

if (targetEffects->throws_ && (parent.tryDepth > 0 || curr->isReturn)) {

auto filteredEffects = *targetEffects;

filteredEffects.throws_ = false;

parent.mergeIn(filteredEffects);

} else {

// Just merge in all the effects.

parent.mergeIn(*targetEffects);

}

return;

}

parent.calls = true;

// When EH is enabled, any call can throw. Skip this for return calls

// because the throw is already more precisely captured by the combination

// of `hasReturnCallThrow` and `branchesOut`.

if (parent.features.hasExceptionHandling() && parent.tryDepth == 0 &&

!curr->isReturn) {

parent.throws_ = true;

}

}

stevenfontanella · 2026-05-15T19:28:48Z

Will run the fuzzer for a few hours.

stevenfontanella · 2026-05-15T22:06:22Z

Ran 3900 iterations with no issues.

stevenfontanella force-pushed the expression-effects branch from 690ee8d to 75481a7 Compare April 19, 2026 08:56

tlively reviewed Apr 20, 2026

View reviewed changes

Comment thread src/ir/effects.h Outdated

stevenfontanella force-pushed the indirect-effects-scc branch from 189d543 to 2630eff Compare April 21, 2026 20:15

stevenfontanella mentioned this pull request Apr 23, 2026

Compute effects for indirect calls in GlobalEffects #8609

Merged

stevenfontanella force-pushed the expression-effects branch from 75481a7 to 36a4fb5 Compare April 23, 2026 23:07

Base automatically changed from indirect-effects-scc to main April 24, 2026 21:36

stevenfontanella force-pushed the expression-effects branch from 36a4fb5 to e65a243 Compare April 24, 2026 22:16

stevenfontanella added 2 commits May 6, 2026 18:05

Use effects for indirect call expressions

58eb5c2

PR updates

253c092

stevenfontanella force-pushed the expression-effects branch 3 times, most recently from 30a31e1 to 60665f3 Compare May 7, 2026 20:33

WIP

2156d99

Gemini WIP Try changing call effects

stevenfontanella force-pushed the expression-effects branch from 60665f3 to 2156d99 Compare May 7, 2026 20:44

stevenfontanella marked this pull request as ready for review May 7, 2026 21:33

stevenfontanella requested a review from a team as a code owner May 7, 2026 21:33

stevenfontanella requested review from aheejin and removed request for a team May 7, 2026 21:33

aheejin reviewed May 12, 2026

View reviewed changes

Comment thread test/lit/passes/global-effects-closed-world-tnh.wast Outdated

Comment thread test/lit/passes/global-effects-closed-world.wast

Comment thread src/ir/effects.h Outdated

Comment thread src/ir/effects.h

stevenfontanella added 2 commits May 12, 2026 16:29

PR updates

7facc2a

Extract a common function for setting effects for function calls

5aac82a

kripken reviewed May 12, 2026

View reviewed changes

Comment thread src/ir/effects.h Outdated

Extract out fix for future PR

63d5515

stevenfontanella requested a review from aheejin May 12, 2026 20:45

kripken reviewed May 12, 2026

View reviewed changes

Comment thread src/ir/effects.h Outdated

Comment thread src/ir/effects.h

Comment thread src/wasm.h

kripken reviewed May 12, 2026

View reviewed changes

Comment thread src/ir/effects.h Outdated

Comment thread src/ir/effects.h

Comment thread src/ir/effects.h

Comment thread src/support/utilities.h Outdated

Comment thread src/ir/effects.h

aheejin reviewed May 12, 2026

View reviewed changes

Comment thread src/ir/effects.h Outdated

Comment thread src/ir/effects.h Outdated

stevenfontanella mentioned this pull request May 13, 2026

Improve indirect call effects in GlobalEffects #8644

Open

PR updates

2fd577a

aheejin reviewed May 13, 2026

View reviewed changes

kripken reviewed May 14, 2026

View reviewed changes

Comment thread src/ir/effects.h Outdated

kripken reviewed May 14, 2026

View reviewed changes

Comment thread src/ir/effects.h

PR updates

979db05

stevenfontanella force-pushed the expression-effects branch from 7eed45c to 979db05 Compare May 15, 2026 04:19

Bring back trap logic for call_indirect

cae5353

	void visitCall(Call* curr) {
	// call.without.effects has no effects.
	if (Intrinsics(parent.module).isCallWithoutEffects(curr)) {
	return;
	}

	// Get the target's effects, if they exist. Note that we must handle the
	// case of the function not yet existing (we may be executed in the middle
	// of a pass, which may have built up calls but not the targets of those
	// calls; in such a case, we do not find the targets and therefore assume
	// we know nothing about the effects, which is safe).
	const EffectAnalyzer* targetEffects = nullptr;
	if (auto* target = parent.module.getFunctionOrNull(curr->target)) {
	targetEffects = target->effects.get();
	}

	if (curr->isReturn) {
	parent.branchesOut = true;
	// When EH is enabled, any call can throw.
	if (parent.features.hasExceptionHandling() &&
	(!targetEffects \|\| targetEffects->throws())) {
	parent.hasReturnCallThrow = true;
	}
	}

	if (targetEffects) {
	// We have effect information for this call target, and can just use
	// that. The one change we may want to make is to remove throws_, if the
	// target function throws and we know that will be caught anyhow, the
	// same as the code below for the general path. We can always filter out
	// throws for return calls because they are already more precisely
	// captured by `branchesOut`, which models the return, and
	// `hasReturnCallThrow`, which models the throw that will happen after
	// the return.
	if (targetEffects->throws_ && (parent.tryDepth > 0 \|\| curr->isReturn)) {
	auto filteredEffects = *targetEffects;
	filteredEffects.throws_ = false;
	parent.mergeIn(filteredEffects);
	} else {
	// Just merge in all the effects.
	parent.mergeIn(*targetEffects);
	}
	return;
	}

	parent.calls = true;
	// When EH is enabled, any call can throw. Skip this for return calls
	// because the throw is already more precisely captured by the combination
	// of `hasReturnCallThrow` and `branchesOut`.
	if (parent.features.hasExceptionHandling() && parent.tryDepth == 0 &&
	!curr->isReturn) {
	parent.throws_ = true;
	}
	}

Conversation

stevenfontanella commented Apr 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

stevenfontanella commented Apr 23, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aheejin May 13, 2026

Choose a reason for hiding this comment

Uh oh!

stevenfontanella May 15, 2026

Choose a reason for hiding this comment

Uh oh!

aheejin May 13, 2026

Choose a reason for hiding this comment

Uh oh!

stevenfontanella May 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

stevenfontanella commented May 15, 2026

Uh oh!

stevenfontanella commented May 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

stevenfontanella commented Apr 19, 2026 •

edited

Loading