Stream: git-wasmtime

Topic: wasmtime / issue #4759 cranelift-fuzzgen fuzzbug: "not ye...

view this post on Zulip Wasmtime GitHub notifications bot (Aug 23 2022 at 15:53):

cfallin opened issue #4759:

https://oss-fuzz.com/testcase-detail/4974131891798016

thread '<unnamed>' panicked at 'not yet implemented', [wasmtime/cranelift/codegen/src/isa/x64/inst/emit.rs:1762](https://github.com/bytecodealliance/wasmtime/blob/d620705a323e3da59bd90473b4e627c8502b1255/cranelift/codegen/src/isa/x64/inst/emit.rs#L1762):22

input:

IFWoAAAAAE0AAABSSUl9LCB7AAUb//8AZfxN88ZGRAKd0g2kJPs9hAAAAAAI/2B5+IIAAQBlPDwA
Ajw8PDxHvLyIgp6CgmCCAAAAAQ0mAQAA6QAAACC2JgH4/wAAAOm2IKYBAOm2/////yAAAAAwVVVV
BXUwOjExdVVVVVVVVVWCgv2CdnaCgoKCgoKCgoJMAAACgoKC/v///YKCgtTUIdTkxMTExMRBQ0QA
AAB4QHAcPQAAAAcAAIKCgoKCRERERERERERERERCQkJCQkJCQkJCQkhCQkJCQkJCQkJCQkJCQkJC
QkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkFCQkJCQkJCQkJCQkJCPDwAAQD///8A/w==

cc @afonso360

view this post on Zulip Wasmtime GitHub notifications bot (Aug 23 2022 at 16:19):

afonso360 commented on issue #4759:

<details>
<summary> Formatted </summary>

ubuntu@instance-20220805-0848:~/git/wasmtime/fuzz$ cargo fuzz fmt cranelift-fuzzgen ./4759.in --no-default-features

Output of `std::fmt::Debug`:

;; Fuzzgen test case

test interpret
test run
set enable_llvm_abi_extensions
target aarch64
target s390x
target x86_64

function u0:1(i128, b1, b1, i128, b1, i16 uext, i8 sext, i64 sext, i32, i128, f64, b1 sext, i64 sext, i32, f32 sext) -> i128, i128 sext system_v {
    ss0 = explicit_slot 60
    ss1 = explicit_slot 60
    ss2 = explicit_slot 60
    ss3 = explicit_slot 71
    ss4 = explicit_slot 59
    ss5 = explicit_slot 59
    sig0 = (i64, i64) -> i64 fast
    sig1 = (i64, i64) -> i64 fast
    fn0 = %UdivI64 sig0
    fn1 = %UdivI64 sig1
    jt0 = jump_table []

block0(v0: i128, v1: b1, v2: b1, v3: i128, v4: b1, v5: i16, v6: i8, v7: i64, v8: i32, v9: i128, v10: f64, v11: b1, v12: i64, v13: i32, v14: f32):
    v25 = iconst.i128 0
    v26 = iconst.i64 0
    v27 = iconst.i32 0
    v28 = iconst.i16 0
    v29 = iconst.i8 0
    stack_store v25, ss0  ; v25 = 0
    stack_store v25, ss0+16  ; v25 = 0
    stack_store v25, ss0+32  ; v25 = 0
    stack_store v26, ss0+48  ; v26 = 0
    stack_store v27, ss0+56  ; v27 = 0
    stack_store v25, ss1  ; v25 = 0
    stack_store v25, ss1+16  ; v25 = 0
    stack_store v25, ss1+32  ; v25 = 0
    stack_store v26, ss1+48  ; v26 = 0
    stack_store v27, ss1+56  ; v27 = 0
    stack_store v25, ss2  ; v25 = 0
    stack_store v25, ss2+16  ; v25 = 0
    stack_store v25, ss2+32  ; v25 = 0
    stack_store v26, ss2+48  ; v26 = 0
    stack_store v27, ss2+56  ; v27 = 0
    stack_store v25, ss3  ; v25 = 0
    stack_store v25, ss3+16  ; v25 = 0
    stack_store v25, ss3+32  ; v25 = 0
    stack_store v25, ss3+48  ; v25 = 0
    stack_store v27, ss3+64  ; v27 = 0
    stack_store v28, ss3+68  ; v28 = 0
    stack_store v29, ss3+70  ; v29 = 0
    stack_store v25, ss4  ; v25 = 0
    stack_store v25, ss4+16  ; v25 = 0
    stack_store v25, ss4+32  ; v25 = 0
    stack_store v26, ss4+48  ; v26 = 0
    stack_store v28, ss4+56  ; v28 = 0
    stack_store v29, ss4+58  ; v29 = 0
    stack_store v25, ss5  ; v25 = 0
    stack_store v25, ss5+16  ; v25 = 0
    stack_store v25, ss5+32  ; v25 = 0
    stack_store v26, ss5+48  ; v26 = 0
    stack_store v28, ss5+56  ; v28 = 0
    stack_store v29, ss5+58  ; v29 = 0
    br_table v8, block3, jt0

block1(v15: i64, v16: b1, v17: b1, v18: b1, v19: b1, v20: b1, v21: f64, v22: b1, v23: i8, v24: b1, v36: i128, v37: i32, v42: i16, v45: i32) cold:
    v30 = iadd v23, v23
    nop
    nop
    v31 = f64const -0x1.126b620000000p897
    v32 = udiv v15, v15
    v33 = f64const -0x1.6e90001a620b6p1020
    v35 = udiv.i64 v34, v34
    nop
    nop
    nop
    v38 = rotr v36, v37
    v40 = iadd.i128 v39, v39
    v41 = rotr v40, v34
    v43 = ishl v37, v42
    v44 = ishl v43, v42
    v46 = ushr v45, v30
    v47 = ushr v45, v30
    v48 = ushr v47, v30
    v49 = ushr v48, v30
    v50 = ushr v49, v30
    v51 = ishl v30, v30
    nop
    nop
    v52 = iadd v42, v42
    v53 = ushr v50, v51
    v54 = udiv v46, v46
    v55 = ushr v53, v51
    v56 = fcmp eq v33, v33  ; v33 = -0x1.6e90001a620b6p1020, v33 = -0x1.6e90001a620b6p1020
    v57 = fcmp one v33, v33  ; v33 = -0x1.6e90001a620b6p1020, v33 = -0x1.6e90001a620b6p1020
    v81 = fma v33, v33, v33  ; v33 = -0x1.6e90001a620b6p1020, v33 = -0x1.6e90001a620b6p1020, v33 = -0x1.6e90001a620b6p1020
    v82 = fcmp ne v81, v81
    v83 = f64const +NaN
    v58 = select v82, v83, v81  ; v83 = +NaN
    v84 = fma v58, v58, v58
    v85 = fcmp ne v84, v84
    v86 = f64const +NaN
    v59 = select v85, v86, v84  ; v86 = +NaN
    v87 = fma v59, v59, v59
    v88 = fcmp ne v87, v87
    v89 = f64const +NaN
    v60 = select v88, v89, v87  ; v89 = +NaN
    v90 = fma v60, v60, v60
    v91 = fcmp ne v90, v90
    v92 = f64const +NaN
    v61 = select v91, v92, v90  ; v92 = +NaN
    v63 = rotl v54, v62
    nop
    nop
    v64 = sshr v41, v35
    v65 = rotl v63, v51
    br_icmp eq v51, v51, block2(v35, v65, v51, v17, v57, v61, v34, v64, v54, v39, v52, v62)
    jump block1(v35, v17, v17, v17, v57, v57, v61, v57, v51, v57, v64, v54, v52, v65)

block2(v66: i64, v67: i32, v70: i8, v72: b1, v73: b1, v74: f64, v75: i64, v76: i128, v77: i32, v78: i128, v79: i16, v80: i128):
    v34 -> v75
    v39 -> v78
    v62 -> v80
    v68 = rotl v66, v67
    v69 = rotl v68, v67
    v71 = rotl v69, v70
    br_icmp ult v67, v67, block1(v71, v72, v72, v72, v73, v72, v74, v72, v70, v72, v76, v77, v79, v67)
    jump block1(v71, v72, v72, v72, v72, v72, v74, v72, v70, v72, v76, v77, v79, v67)

block3:
    jump block2(v7, v8, v6, v4, v1, v10, v12, v3, v13, v0, v5, v9)
}

; Note: the results in the below test cases are simply a placeholder and probably will be wrong

; run: u0:1(88073083203066425837579310158810595906, false, false, 88073083203066425837579028683833885250, false, 16962, 66, -1099494835140, 65280, 0, 0.0, false, 0, 0, 0.0) == [0, 0]
; run: u0:1(0, false, false, 0, false, 0, 0, 0, 0, 0, 0.0, false, 0, 0, 0.0) == [0, 0]
; run: u0:1(0, false, false, 0, false, 0, 0, 0, 0, 0, 0.0, false, 0, 0, 0.0) == [0, 0]
; run: u0:1(0, false, false, 0, false, 0, 0, 0, 0, 0, 0.0, false, 0, 0, 0.0) == [0, 0]
; run: u0:1(0, false, false, 0, false, 0, 0, 0, 0, 0, 0.0, false, 0, 0, 0.0) == [0, 0]
; run: u0:1(0, false, false, 0, false, 0, 0, 0, 0, 0, 0.0, false, 0, 0, 0.0) == [0, 0]
; run: u0:1(0, false, false, 0, false, 0, 0, 0, 0, 0, 0.0, false, 0, 0, 0.0) == [0, 0]

</details>

view this post on Zulip Wasmtime GitHub notifications bot (Aug 23 2022 at 16:21):

bjorn3 commented on issue #4759:

Fails at https://github.com/bytecodealliance/wasmtime/blob/418dbc15bd2a5269b338587661387e05fc77b983/cranelift/codegen/src/isa/x64/inst/emit.rs#L1762 when emitting a XmmRmRVex.

view this post on Zulip Wasmtime GitHub notifications bot (Aug 23 2022 at 16:26):

abrown commented on issue #4759:

Looks like it could be time to add the memory addressing encodings to VEX and EVEX.

view this post on Zulip Wasmtime GitHub notifications bot (Aug 24 2022 at 17:35):

jameysharp closed issue #4759:

https://oss-fuzz.com/testcase-detail/4974131891798016

thread '<unnamed>' panicked at 'not yet implemented', [wasmtime/cranelift/codegen/src/isa/x64/inst/emit.rs:1762](https://github.com/bytecodealliance/wasmtime/blob/d620705a323e3da59bd90473b4e627c8502b1255/cranelift/codegen/src/isa/x64/inst/emit.rs#L1762):22

input:

IFWoAAAAAE0AAABSSUl9LCB7AAUb//8AZfxN88ZGRAKd0g2kJPs9hAAAAAAI/2B5+IIAAQBlPDwA
Ajw8PDxHvLyIgp6CgmCCAAAAAQ0mAQAA6QAAACC2JgH4/wAAAOm2IKYBAOm2/////yAAAAAwVVVV
BXUwOjExdVVVVVVVVVWCgv2CdnaCgoKCgoKCgoJMAAACgoKC/v///YKCgtTUIdTkxMTExMRBQ0QA
AAB4QHAcPQAAAAcAAIKCgoKCRERERERERERERERCQkJCQkJCQkJCQkhCQkJCQkJCQkJCQkJCQkJC
QkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkFCQkJCQkJCQkJCQkJCPDwAAQD///8A/w==

cc @afonso360

Last updated: Nov 22 2024 at 16:03 UTC