Stream: git-wasmtime

Topic: wasmtime / issue #3161 Panic in x64 simd lowering

view this post on Zulip Wasmtime GitHub notifications bot (Aug 06 2021 at 15:56):

alexcrichton opened issue #3161:

Found via fuzzing last night, feeding this wasm into wasmtime yields:

$ cargo run testcase0.wat --enable-simd
    Finished dev [unoptimized + debuginfo] target(s) in 0.22s
     Running `target/debug/wasmtime testcase0.wat --enable-simd`
thread '<unnamed>' panicked at 'assertion failed: input_ty == types::I32X4 || output_ty == types::F64X2', cranelift/codegen/src/isa/x64/lower.rs:4587:17
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

view this post on Zulip Wasmtime GitHub notifications bot (Aug 06 2021 at 16:37):

abrown commented on issue #3161:

Helpful link to the assertion failure: https://github.com/bytecodealliance/wasmtime/blob/main/cranelift/codegen/src/isa/x64/lower.rs#L4587.

view this post on Zulip Wasmtime GitHub notifications bot (Aug 06 2021 at 16:37):

alexcrichton commented on issue #3161:

Reducing this a bit I got three separate panics:

$ cat foo.wat foo1.wat foo2.wat
(module
  (func (result v128)
    f32.const 0
    f32x4.splat
    i32x4.extend_low_i16x8_u
    i32x4.extend_low_i16x8_u
    i32x4.extend_low_i16x8_u
    f64x2.convert_low_i32x4_u
    i64x2.extend_high_i32x4_s
    i32x4.extend_low_i16x8_u
    i32x4.extend_low_i16x8_u
    i32x4.extend_low_i16x8_u
    f32x4.convert_i32x4_u
    i16x8.extadd_pairwise_i8x16_s)
  (memory 1)
)
(module
  (func (result v128)
    f32.const 0
    f32x4.splat
    f32x4.nearest)
  (memory 1)
)
(module
  (func (result v128)
    f32.const 0
    f32x4.splat
    f64x2.ceil)
  (memory 1)
)

$ cargo run --features all-arch compile --enable-simd --target x86_64 ./foo.wat
    Finished dev [unoptimized] target(s) in 0.12s
     Running `target/debug/wasmtime compile --enable-simd --target x86_64 ./foo.wat`
thread 'main' panicked at 'assertion failed: input_ty == types::I32X4 || output_ty == types::F64X2', cranelift/codegen/src/isa/x64/lower.rs:4587:17
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
$ cargo run --features all-arch compile --enable-simd --target x86_64 ./foo1.wat
    Finished dev [unoptimized] target(s) in 0.12s
     Running `target/debug/wasmtime compile --enable-simd --target x86_64 ./foo1.wat`
thread 'main' panicked at 'unexpected type/opcode types::F32X4/Nearest in Ceil/Floor/Nearest/Trunc', cranelift/codegen/src/isa/x64/lower.rs:5520:26
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
$ cargo run --features all-arch compile --enable-simd --target x86_64 ./foo2.wat
    Finished dev [unoptimized] target(s) in 0.12s
     Running `target/debug/wasmtime compile --enable-simd --target x86_64 ./foo2.wat`
thread 'main' panicked at 'unexpected type/opcode types::F64X2/Ceil in Ceil/Floor/Nearest/Trunc', cranelift/codegen/src/isa/x64/lower.rs:5520:26
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

view this post on Zulip Wasmtime GitHub notifications bot (Aug 06 2021 at 16:38):

alexcrichton labeled issue #3161:

Found via fuzzing last night, feeding this wasm into wasmtime yields:

$ cargo run testcase0.wat --enable-simd
    Finished dev [unoptimized + debuginfo] target(s) in 0.22s
     Running `target/debug/wasmtime testcase0.wat --enable-simd`
thread '<unnamed>' panicked at 'assertion failed: input_ty == types::I32X4 || output_ty == types::F64X2', cranelift/codegen/src/isa/x64/lower.rs:4587:17
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

view this post on Zulip Wasmtime GitHub notifications bot (Aug 06 2021 at 16:38):

alexcrichton labeled issue #3161:

Found via fuzzing last night, feeding this wasm into wasmtime yields:

$ cargo run testcase0.wat --enable-simd
    Finished dev [unoptimized + debuginfo] target(s) in 0.22s
     Running `target/debug/wasmtime testcase0.wat --enable-simd`
thread '<unnamed>' panicked at 'assertion failed: input_ty == types::I32X4 || output_ty == types::F64X2', cranelift/codegen/src/isa/x64/lower.rs:4587:17
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

view this post on Zulip Wasmtime GitHub notifications bot (Aug 06 2021 at 16:38):

alexcrichton labeled issue #3161:

Found via fuzzing last night, feeding this wasm into wasmtime yields:

$ cargo run testcase0.wat --enable-simd
    Finished dev [unoptimized + debuginfo] target(s) in 0.22s
     Running `target/debug/wasmtime testcase0.wat --enable-simd`
thread '<unnamed>' panicked at 'assertion failed: input_ty == types::I32X4 || output_ty == types::F64X2', cranelift/codegen/src/isa/x64/lower.rs:4587:17
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

view this post on Zulip Wasmtime GitHub notifications bot (Aug 06 2021 at 16:40):

abrown commented on issue #3161:

Here's a link for the Ceil/Nearest libcall assertion: https://github.com/bytecodealliance/wasmtime/blob/main/cranelift/codegen/src/isa/x64/lower.rs#L5520.

view this post on Zulip Wasmtime GitHub notifications bot (Aug 06 2021 at 16:43):

abrown commented on issue #3161:

For Ceil and Nearest it looks like you need to enable SSE4.1... is it --target "x86_64 nehalem" or something like that?

view this post on Zulip Wasmtime GitHub notifications bot (Aug 06 2021 at 16:44):

abrown edited a comment on issue #3161:

For Ceil and Nearest it looks like you need to enable SSE4.1... is it --target "x86_64 nehalem" or something like that? (That's the type of thing I would have to do using the Cranelift CLI).

view this post on Zulip Wasmtime GitHub notifications bot (Aug 06 2021 at 16:47):

jlb6740 commented on issue #3161:

This is asserting on a recent patch. Am I reading this correct, the input to i16x8.extadd_pairwise_i8x16_s is f32x4.convert_i32x4_u here?

view this post on Zulip Wasmtime GitHub notifications bot (Aug 06 2021 at 16:49):

abrown commented on issue #3161:

(That's the type of thing I would have to do using the Cranelift CLI).

But this highlights that we might want to have a better default feature baseline in the Wasmtime CLI. SSE4.1 is very, very common.

view this post on Zulip Wasmtime GitHub notifications bot (Aug 06 2021 at 16:50):

alexcrichton commented on issue #3161:

Er yes looks like my reduction went astray, I was assuming the target features didn't matter for the panics I was seeing. I've hidden my comment to avoid distractions, and the re-reduction is:

(module
  (func (result i32)
    v128.const i32x4 0x00000000 0x00000000 0x00000000 0x00000000
    i32x4.extend_low_i16x8_u
    f32x4.convert_i32x4_u
    i8x16.extract_lane_s 10))

view this post on Zulip Wasmtime GitHub notifications bot (Aug 06 2021 at 16:50):

alexcrichton edited a comment on issue #3161:

Er yes looks like my reduction went astray, I was assuming the target features didn't matter for the panics I was seeing. I've hidden my comment to avoid distractions, and the re-reduction is:

(module
  (func (result i32)
    v128.const i32x4 0x00000000 0x00000000 0x00000000 0x00000000
    i32x4.extend_low_i16x8_u
    f32x4.convert_i32x4_u
    i8x16.extract_lane_s 10))

view this post on Zulip Wasmtime GitHub notifications bot (Aug 06 2021 at 16:57):

jlb6740 commented on issue #3161:

This is something I recently wrote. There is tension here between the strictness of our assertions for cranelift instructions versus what the wasm spec says is allowed.

view this post on Zulip Wasmtime GitHub notifications bot (Aug 06 2021 at 16:59):

jlb6740 commented on issue #3161:

I think the assert line highlighted can be removed.

view this post on Zulip Wasmtime GitHub notifications bot (Aug 18 2021 at 20:01):

jlb6740 assigned issue #3161 (assigned to jlb6740):

Found via fuzzing last night, feeding this wasm into wasmtime yields:

$ cargo run testcase0.wat --enable-simd
    Finished dev [unoptimized + debuginfo] target(s) in 0.22s
     Running `target/debug/wasmtime testcase0.wat --enable-simd`
thread '<unnamed>' panicked at 'assertion failed: input_ty == types::I32X4 || output_ty == types::F64X2', cranelift/codegen/src/isa/x64/lower.rs:4587:17
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

view this post on Zulip Wasmtime GitHub notifications bot (Sep 03 2021 at 19:14):

alexcrichton commented on issue #3161:

Fixed in #3209, so closing.

view this post on Zulip Wasmtime GitHub notifications bot (Sep 03 2021 at 19:14):

alexcrichton closed issue #3161 (assigned to jlb6740):

Found via fuzzing last night, feeding this wasm into wasmtime yields:

$ cargo run testcase0.wat --enable-simd
    Finished dev [unoptimized + debuginfo] target(s) in 0.22s
     Running `target/debug/wasmtime testcase0.wat --enable-simd`
thread '<unnamed>' panicked at 'assertion failed: input_ty == types::I32X4 || output_ty == types::F64X2', cranelift/codegen/src/isa/x64/lower.rs:4587:17
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Last updated: Nov 22 2024 at 16:03 UTC