Relaxed Wasm SIMD implementation

85da494

Source/JavaScriptCore/wasm/WasmSIMDOpcodes.h

JSTests/wasm/stress/simd-const-relaxed-f32-madd.js

JSC compiles Wasm through a tiered pipeline: IPInt interprets bytecode directly, BBQ emits fast unoptimized machine code, and OMG runs a full B3-based optimizing compiler. Relaxed SIMD is a Wasm proposal that intentionally permits implementation-defined behavior within specified bounds — operations like relaxed_min and lane_select may produce different results depending on the underlying hardware instruction.

This commit implements relaxed Wasm SIMD across all three tiers for both x64 and ARM64. New operations: dot product variants (i16x8.relaxed_dot_i8x16_i7x16_s, i32x4.relaxed_dot_i8x16_i7x16_add_s), relaxed min/max, and Q15 multiply-rounding. FMA and truncation operations already existed but were gated behind --useWasmIPIntSIMD=0 and no-jit skip flags; this commit removes those gates.

Wasm relaxed SIMD opcode
        │
        ▼
  FunctionParser.h (decode)
        │
   ┌────┴────────────────┐
   │                     │
   ▼                     ▼
IPInt                  BBQ / OMG
(InPlaceInterpreter    (WasmBBQJIT64.cpp /
 .asm)                  WasmOMGIRGenerator.cpp)
                              │
                         B3 SIMDValue
                         (new opcodes)
                              │
                         B3LowerToAir
                              │
                         Air opcodes
                              │
                    MacroAssembler layer
                  (ARM64 / x86_64 SIMD insns)

Significance

This adds substantial new attack surface: four new SIMD operation families, each with three independent tier implementations, new B3 IR opcodes, new Air opcodes, and new assembler primitives — and the relaxed SIMD spec's intentional non-determinism gives bugs cover, since an incorrect result may still appear "within spec" on paper.

Audit directions