Stream: git-wasmtime

Topic: wasmtime / issue #5417 Unreachable ISLE assertion error o...

view this post on Zulip Wasmtime GitHub notifications bot (Dec 12 2022 at 15:54):

alexcrichton opened issue #5417:

Given this input as foo.clif:

;; Fuzzgen test case

test compile
set opt_level=speed
set enable_alias_analysis=false
set use_egraphs=true
set enable_simd=true
set enable_safepoints=true
set enable_llvm_abi_extensions=true
set unwind_info=false
set preserve_frame_pointers=true
set machine_code_cfg_info=true
set enable_jump_tables=false
set enable_incremental_compilation_cache_checks=true
target x86_64

function %my_fn(i16 uext, i32, i32, i64 uext, f32 uext, i32 sext, i128 uext, i16 uext, i8, i8) system_v {
    ss0 = explicit_slot 99
    ss1 = explicit_slot 19

block0(v0: i16, v1: i32, v2: i32, v3: i64, v4: f32, v5: i32, v6: i128, v7: i16, v8: i8, v9: i8):
    v10 = iconst.i8 97
    v11 = iconst.i16 0
    v12 = iconst.i8 0
    v13 = iconst.i8 0
    v14 = iconst.i8 0
    v15 = iconst.i8 0
    v16 = iconst.i8 0
    v17 = iconst.i8 -113
    v18 = iconst.i8 0
    v19 = iconst.i16 0
    v20 = iconst.i32 0
    v21 = iconst.i64 0
    v22 = uextend.i128 v21  ; v21 = 0
    stack_store v22, ss1
    stack_store v19, ss1+16  ; v19 = 0
    stack_store v18, ss1+18  ; v18 = 0
    stack_store v22, ss0
    stack_store v22, ss0+16
    stack_store v22, ss0+32
    stack_store v22, ss0+48
    stack_store v22, ss0+64
    stack_store v22, ss0+80
    stack_store v19, ss0+96  ; v19 = 0
    stack_store v18, ss0+98  ; v18 = 0
    v23 = ireduce.i8 v3
    v24 = rotl v14, v17  ; v14 = 0, v17 = -113
    v25 = rotr v8, v3
    nop
    nop
    nop
    v26 = sshr v16, v3  ; v16 = 0
    v27 = stack_addr.i64 ss1+8
    v28 = uload8.i32 v27
    v29 = uextend.i64 v13  ; v13 = 0
    v30 = rotr v6, v29
    v31 = uextend.i128 v0
    v32 = stack_addr.i64 ss0+4
    v33 = sload8.i32 v32
    v34 = icmp eq v31, v31
    v35 = select_spectre_guard v34, v11, v7  ; v11 = 0
    return
}

; Note: the results in the below test cases are simply a placeholder and probably will be wrong

; run: %my_fn(6330, 786432, 0, 0, 0.0, 0, 0, 0, 0, 0)
; run: %my_fn(0, 0, 0, 0, 0.0, 0, 0, 0, 0, 0)

The main branch fails with:

$ cargo run -p cranelift-tools -- test ./foo.clif
...
thread 'worker #0' panicked at 'internal error: entered unreachable code: implemented in ISLE: inst = `v35 = select_spectre_guard.i16 v47, v11, v7  ; v47 = 1, v11 = 0`, type = `Some(types::I16)`', cranelift/codegen/src/isa/x64/lower.rs:477:13
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
 ERROR cranelift_filetests::concurrent > FAIL: panicked in worker #0: internal error: entered unreachable code: implemented in ISLE: inst = `v35 = select_spectre_guard.i16 v47, v11, v7  ; v47 = 1, v11 = 0`, type = `Some(types::I16)`
FAIL ./foo.clif: panicked in worker #0: internal error: entered unreachable code: implemented in ISLE: inst = `v35 = select_spectre_guard.i16 v47, v11, v7  ; v47 = 1, v11 = 0`, type = `Some(types::I16)`
1 tests
Error: 1 failure

Bisection points to #5409 as the culprit here (cc @jameysharp and @cfallin)

view this post on Zulip Wasmtime GitHub notifications bot (Dec 12 2022 at 15:54):

alexcrichton labeled issue #5417:

Given this input as foo.clif:

;; Fuzzgen test case

test compile
set opt_level=speed
set enable_alias_analysis=false
set use_egraphs=true
set enable_simd=true
set enable_safepoints=true
set enable_llvm_abi_extensions=true
set unwind_info=false
set preserve_frame_pointers=true
set machine_code_cfg_info=true
set enable_jump_tables=false
set enable_incremental_compilation_cache_checks=true
target x86_64

function %my_fn(i16 uext, i32, i32, i64 uext, f32 uext, i32 sext, i128 uext, i16 uext, i8, i8) system_v {
    ss0 = explicit_slot 99
    ss1 = explicit_slot 19

block0(v0: i16, v1: i32, v2: i32, v3: i64, v4: f32, v5: i32, v6: i128, v7: i16, v8: i8, v9: i8):
    v10 = iconst.i8 97
    v11 = iconst.i16 0
    v12 = iconst.i8 0
    v13 = iconst.i8 0
    v14 = iconst.i8 0
    v15 = iconst.i8 0
    v16 = iconst.i8 0
    v17 = iconst.i8 -113
    v18 = iconst.i8 0
    v19 = iconst.i16 0
    v20 = iconst.i32 0
    v21 = iconst.i64 0
    v22 = uextend.i128 v21  ; v21 = 0
    stack_store v22, ss1
    stack_store v19, ss1+16  ; v19 = 0
    stack_store v18, ss1+18  ; v18 = 0
    stack_store v22, ss0
    stack_store v22, ss0+16
    stack_store v22, ss0+32
    stack_store v22, ss0+48
    stack_store v22, ss0+64
    stack_store v22, ss0+80
    stack_store v19, ss0+96  ; v19 = 0
    stack_store v18, ss0+98  ; v18 = 0
    v23 = ireduce.i8 v3
    v24 = rotl v14, v17  ; v14 = 0, v17 = -113
    v25 = rotr v8, v3
    nop
    nop
    nop
    v26 = sshr v16, v3  ; v16 = 0
    v27 = stack_addr.i64 ss1+8
    v28 = uload8.i32 v27
    v29 = uextend.i64 v13  ; v13 = 0
    v30 = rotr v6, v29
    v31 = uextend.i128 v0
    v32 = stack_addr.i64 ss0+4
    v33 = sload8.i32 v32
    v34 = icmp eq v31, v31
    v35 = select_spectre_guard v34, v11, v7  ; v11 = 0
    return
}

; Note: the results in the below test cases are simply a placeholder and probably will be wrong

; run: %my_fn(6330, 786432, 0, 0, 0.0, 0, 0, 0, 0, 0)
; run: %my_fn(0, 0, 0, 0, 0.0, 0, 0, 0, 0, 0)

The main branch fails with:

$ cargo run -p cranelift-tools -- test ./foo.clif
...
thread 'worker #0' panicked at 'internal error: entered unreachable code: implemented in ISLE: inst = `v35 = select_spectre_guard.i16 v47, v11, v7  ; v47 = 1, v11 = 0`, type = `Some(types::I16)`', cranelift/codegen/src/isa/x64/lower.rs:477:13
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
 ERROR cranelift_filetests::concurrent > FAIL: panicked in worker #0: internal error: entered unreachable code: implemented in ISLE: inst = `v35 = select_spectre_guard.i16 v47, v11, v7  ; v47 = 1, v11 = 0`, type = `Some(types::I16)`
FAIL ./foo.clif: panicked in worker #0: internal error: entered unreachable code: implemented in ISLE: inst = `v35 = select_spectre_guard.i16 v47, v11, v7  ; v47 = 1, v11 = 0`, type = `Some(types::I16)`
1 tests
Error: 1 failure

Bisection points to #5409 as the culprit here (cc @jameysharp and @cfallin)

view this post on Zulip Wasmtime GitHub notifications bot (Dec 12 2022 at 16:33):

afonso360 commented on issue #5417:

A minimized example:

test compile
set opt_level=speed
set use_egraphs=true
target x86_64

function %my_fn(i16) system_v {
block0(v0: i16):
    v1 = icmp eq v0, v0
    v2 = select_spectre_guard v1, v1, v1
    return
}
; run: %my_fn(6330)

I think what's happening here is that the icmp is being optimized into a iconst.i16 1 due to the new egraph rules. And we don't have any rules in the backend to lower a generic select_spectre_guard. (see also #5206)

view this post on Zulip Wasmtime GitHub notifications bot (Dec 13 2022 at 01:13):

cfallin closed issue #5417:

Given this input as foo.clif:

;; Fuzzgen test case

test compile
set opt_level=speed
set enable_alias_analysis=false
set use_egraphs=true
set enable_simd=true
set enable_safepoints=true
set enable_llvm_abi_extensions=true
set unwind_info=false
set preserve_frame_pointers=true
set machine_code_cfg_info=true
set enable_jump_tables=false
set enable_incremental_compilation_cache_checks=true
target x86_64

function %my_fn(i16 uext, i32, i32, i64 uext, f32 uext, i32 sext, i128 uext, i16 uext, i8, i8) system_v {
    ss0 = explicit_slot 99
    ss1 = explicit_slot 19

block0(v0: i16, v1: i32, v2: i32, v3: i64, v4: f32, v5: i32, v6: i128, v7: i16, v8: i8, v9: i8):
    v10 = iconst.i8 97
    v11 = iconst.i16 0
    v12 = iconst.i8 0
    v13 = iconst.i8 0
    v14 = iconst.i8 0
    v15 = iconst.i8 0
    v16 = iconst.i8 0
    v17 = iconst.i8 -113
    v18 = iconst.i8 0
    v19 = iconst.i16 0
    v20 = iconst.i32 0
    v21 = iconst.i64 0
    v22 = uextend.i128 v21  ; v21 = 0
    stack_store v22, ss1
    stack_store v19, ss1+16  ; v19 = 0
    stack_store v18, ss1+18  ; v18 = 0
    stack_store v22, ss0
    stack_store v22, ss0+16
    stack_store v22, ss0+32
    stack_store v22, ss0+48
    stack_store v22, ss0+64
    stack_store v22, ss0+80
    stack_store v19, ss0+96  ; v19 = 0
    stack_store v18, ss0+98  ; v18 = 0
    v23 = ireduce.i8 v3
    v24 = rotl v14, v17  ; v14 = 0, v17 = -113
    v25 = rotr v8, v3
    nop
    nop
    nop
    v26 = sshr v16, v3  ; v16 = 0
    v27 = stack_addr.i64 ss1+8
    v28 = uload8.i32 v27
    v29 = uextend.i64 v13  ; v13 = 0
    v30 = rotr v6, v29
    v31 = uextend.i128 v0
    v32 = stack_addr.i64 ss0+4
    v33 = sload8.i32 v32
    v34 = icmp eq v31, v31
    v35 = select_spectre_guard v34, v11, v7  ; v11 = 0
    return
}

; Note: the results in the below test cases are simply a placeholder and probably will be wrong

; run: %my_fn(6330, 786432, 0, 0, 0.0, 0, 0, 0, 0, 0)
; run: %my_fn(0, 0, 0, 0, 0.0, 0, 0, 0, 0, 0)

The main branch fails with:

$ cargo run -p cranelift-tools -- test ./foo.clif
...
thread 'worker #0' panicked at 'internal error: entered unreachable code: implemented in ISLE: inst = `v35 = select_spectre_guard.i16 v47, v11, v7  ; v47 = 1, v11 = 0`, type = `Some(types::I16)`', cranelift/codegen/src/isa/x64/lower.rs:477:13
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
 ERROR cranelift_filetests::concurrent > FAIL: panicked in worker #0: internal error: entered unreachable code: implemented in ISLE: inst = `v35 = select_spectre_guard.i16 v47, v11, v7  ; v47 = 1, v11 = 0`, type = `Some(types::I16)`
FAIL ./foo.clif: panicked in worker #0: internal error: entered unreachable code: implemented in ISLE: inst = `v35 = select_spectre_guard.i16 v47, v11, v7  ; v47 = 1, v11 = 0`, type = `Some(types::I16)`
1 tests
Error: 1 failure

Bisection points to #5409 as the culprit here (cc @jameysharp and @cfallin)

Last updated: Oct 23 2024 at 20:03 UTC