wasmtime / issue #5086 Cranelift: `ushr`+`isplit` miscomp... · git-wasmtime

Stream: git-wasmtime

Topic: wasmtime / issue #5086 Cranelift: `ushr`+`isplit` miscomp...

Wasmtime GitHub notifications bot (Oct 20 2022 at 20:28):

afonso360 edited issue #5086:

:wave: Hey,

This turned up while fuzzing #5075 but it's also reproducible on main, so I'm filing a separate issue.

`.clif` Test Case

test interpret
test run
set opt_level=speed_and_size
set use_egraphs=true
set enable_llvm_abi_extensions=true
target x86_64

function %a(i128) -> i32 {
block0(v0: i128):
    v1 = iconst.i32 -1
    v2, v3 = isplit v0
    v4 = ushr v1, v3
    return v4
}

; run: %a(871558149430564685057836279141) == 2147483647

Steps to Reproduce

clif-util test ./the-above

Expected Results

The test to pass

Actual Results

FAIL ./lmao.clif: run

Caused by:
    Failed test: run: %a(871558149430564685057836279141) == 2147483647, actual: 1
1 tests
Error: 1 failure

Versions and Environment

Cranelift version or commit: main
Operating system: Windows
Architecture: x86_64

Extra Info

This is not reproducible on AArch64, so it might be something wrong with the x86 lowerings. However it also passes with use_egraphs=false so I'm not sure.

After the egraphs pass we get this in the trace log:

 DEBUG cranelift_codegen::context              > After egraph optimization:
function u0:0(i128) -> i32 system_v {
                                block0(v0: i128):
                                    v1 = iconst.i32 -1
                                    v2, v3 = isplit v0
                                    v4 = ushr v1, v3  ; v1 = -1, v3 = -1
                                    return v4
}

I'm not sure why it's marking v3 as -1 since it shouldn't know that.

Assembly with use_egraphs=true:

afonso@DESKTOP-VSTS4BC:~/git/wasmtime/cranelift$ cargo run -- compile --set opt_level=speed_and_size --set use_egraphs=true --set enable_llvm_abi_extensions=true --target x86_64 -D ./lmao.clif
    Finished dev [unoptimized + debuginfo] target(s) in 0.15s
     Running `/home/afonso/git/wasmtime/target/debug/clif-util compile --set opt_level=speed_and_size --set use_egraphs=true --set enable_llvm_abi_extensions=true --target x86_64 -D ./lmao.clif`
.byte 85, 72, 137, 229, 184, 255, 255, 255, 255, 193, 232, 31, 72, 137, 236, 93, 195

Disassembly of 17 bytes:
   0:   55                      push    rbp
   1:   48 89 e5                mov     rbp, rsp
   4:   b8 ff ff ff ff          mov     eax, 0xffffffff
   9:   c1 e8 1f                shr     eax, 0x1f
   c:   48 89 ec                mov     rsp, rbp
   f:   5d                      pop     rbp
  10:   c3                      ret

Assembly with use_egraphs=false:

afonso@DESKTOP-VSTS4BC:~/git/wasmtime/cranelift$ cargo run -- compile --set opt_level=speed_and_size --set use_egraphs=false --set enable_llvm_abi_extensions=true --target x86_64 -D ./lmao.clif
    Finished dev [unoptimized + debuginfo] target(s) in 0.15s
     Running `/home/afonso/git/wasmtime/target/debug/clif-util compile --set opt_level=speed_and_size --set use_egraphs=false --set enable_llvm_abi_extensions=true --target x86_64 -D ./lmao.clif`
.byte 85, 72, 137, 229, 184, 255, 255, 255, 255, 72, 137, 241, 211, 232, 72, 137, 236, 93, 195

Disassembly of 19 bytes:
   0:   55                      push    rbp
   1:   48 89 e5                mov     rbp, rsp
   4:   b8 ff ff ff ff          mov     eax, 0xffffffff
   9:   48 89 f1                mov     rcx, rsi
   c:   d3 e8                   shr     eax, cl
   e:   48 89 ec                mov     rsp, rbp
  11:   5d                      pop     rbp
  12:   c3                      ret

cc: @cfallin

Wasmtime GitHub notifications bot (Oct 21 2022 at 17:24):

cfallin closed issue #5086:

:wave: Hey,

This turned up while fuzzing #5075 but it's also reproducible on main, so I'm filing a separate issue.

`.clif` Test Case

test interpret
test run
set opt_level=speed_and_size
set use_egraphs=true
set enable_llvm_abi_extensions=true
target x86_64

function %a(i128) -> i32 {
block0(v0: i128):
    v1 = iconst.i32 -1
    v2, v3 = isplit v0
    v4 = ushr v1, v3
    return v4
}

; run: %a(871558149430564685057836279141) == 2147483647

Steps to Reproduce

clif-util test ./the-above

Expected Results

The test to pass

Actual Results

FAIL ./lmao.clif: run

Caused by:
    Failed test: run: %a(871558149430564685057836279141) == 2147483647, actual: 1
1 tests
Error: 1 failure

Versions and Environment

Cranelift version or commit: main
Operating system: Windows
Architecture: x86_64

Extra Info

This is not reproducible on AArch64, so it might be something wrong with the x86 lowerings. However it also passes with use_egraphs=false so I'm not sure.

After the egraphs pass we get this in the trace log:

 DEBUG cranelift_codegen::context              > After egraph optimization:
function u0:0(i128) -> i32 system_v {
                                block0(v0: i128):
                                    v1 = iconst.i32 -1
                                    v2, v3 = isplit v0
                                    v4 = ushr v1, v3  ; v1 = -1, v3 = -1
                                    return v4
}

I'm not sure why it's marking v3 as -1 since it shouldn't know that.

Assembly with use_egraphs=true:

afonso@DESKTOP-VSTS4BC:~/git/wasmtime/cranelift$ cargo run -- compile --set opt_level=speed_and_size --set use_egraphs=true --set enable_llvm_abi_extensions=true --target x86_64 -D ./lmao.clif
    Finished dev [unoptimized + debuginfo] target(s) in 0.15s
     Running `/home/afonso/git/wasmtime/target/debug/clif-util compile --set opt_level=speed_and_size --set use_egraphs=true --set enable_llvm_abi_extensions=true --target x86_64 -D ./lmao.clif`
.byte 85, 72, 137, 229, 184, 255, 255, 255, 255, 193, 232, 31, 72, 137, 236, 93, 195

Disassembly of 17 bytes:
   0:   55                      push    rbp
   1:   48 89 e5                mov     rbp, rsp
   4:   b8 ff ff ff ff          mov     eax, 0xffffffff
   9:   c1 e8 1f                shr     eax, 0x1f
   c:   48 89 ec                mov     rsp, rbp
   f:   5d                      pop     rbp
  10:   c3                      ret

Assembly with use_egraphs=false:

afonso@DESKTOP-VSTS4BC:~/git/wasmtime/cranelift$ cargo run -- compile --set opt_level=speed_and_size --set use_egraphs=false --set enable_llvm_abi_extensions=true --target x86_64 -D ./lmao.clif
    Finished dev [unoptimized + debuginfo] target(s) in 0.15s
     Running `/home/afonso/git/wasmtime/target/debug/clif-util compile --set opt_level=speed_and_size --set use_egraphs=false --set enable_llvm_abi_extensions=true --target x86_64 -D ./lmao.clif`
.byte 85, 72, 137, 229, 184, 255, 255, 255, 255, 72, 137, 241, 211, 232, 72, 137, 236, 93, 195

Disassembly of 19 bytes:
   0:   55                      push    rbp
   1:   48 89 e5                mov     rbp, rsp
   4:   b8 ff ff ff ff          mov     eax, 0xffffffff
   9:   48 89 f1                mov     rcx, rsi
   c:   d3 e8                   shr     eax, cl
   e:   48 89 ec                mov     rsp, rbp
  11:   5d                      pop     rbp
  12:   c3                      ret

cc: @cfallin

Last updated: Dec 23 2024 at 12:05 UTC

Stream: git-wasmtime

Topic: wasmtime / issue #5086 Cranelift: `ushr`+`isplit` miscomp...

Wasmtime GitHub notifications bot (Oct 20 2022 at 20:28):

.clif Test Case

Steps to Reproduce

Expected Results

Actual Results

Versions and Environment

Extra Info

Wasmtime GitHub notifications bot (Oct 21 2022 at 17:24):

.clif Test Case

Steps to Reproduce

Expected Results

Actual Results

Versions and Environment

Extra Info

`.clif` Test Case

`.clif` Test Case