Stream: git-wasmtime

Topic: wasmtime / Issue #1109 Miscompile with `fold_redundant_ju...

Wasmtime GitHub notifications bot (Feb 03 2021 at 17:23):

bjorn3 commented on Issue #1109:

In new backend framework fold_redundant_jumps doesn't exist.

Wasmtime GitHub notifications bot (Feb 03 2021 at 18:15):

cfallin closed Issue #1109:

With this testcase:

(module
  (func $dummy)

  (func (export "as-binary-operand") (result i32)
    (i32.mul
      (loop (result i32) (i32.const 3))
      (loop (result i32) (i32.const 4))
    )
  )
)

This command:

clif-util wasm -p --target x86_64 test.wast

gets this error:

function u0:1(i64 vmctx [%rdi], i64 fp [%rbp]) -> i32 [%rax], i64 fp [%rbp] system_v {
    ss0 = incoming_arg 16, offset -16

                                ebb0(v0: i64 [%rdi], v7: i64 [%rbp]):
[RexOp1pushq#50]                    x86_push v7
[RexOp1copysp#8089]                 copy_special %rsp -> %rbp
@0036 [-]                           fallthrough ebb2

                                ebb2:
@0038 [RexOp1pu_id#b8,%rax]         v3 = iconst.i32 3
@003a [-]                           fallthrough ebb4

                                ebb4:
@003d [RexOp1pu_id#b8,%rcx]         v5 = iconst.i32 4
@003f [-]                           fallthrough ebb5(v5)

                                ebb5(v4: i32 [%rcx]):
@0040 [RexOp2rrx#4af,%rax]          v6 = imul.i32 v2, v4
;~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
; error: inst6: v2 is defined by ebb3 which is not in the layout

@0041 [-]                           fallthrough ebb1(v6)

                                ebb1(v1: i32 [%rax]):
[RexOp1popq#58,%rbp]                v8 = x86_pop.i64
@0041 [Op1ret#c3]                   return v1, v8
}

Bisection points to 57fa45c8520110ee7e9b216538f1990376aed0e9, and the error goes away when I comment out the call to fold_redundant_jumps.

Last updated: Dec 23 2024 at 12:05 UTC