Stream: git-wasmtime

Topic: wasmtime / issue #5583 Panic in isel for riscv64 backend

view this post on Zulip Wasmtime GitHub notifications bot (Jan 17 2023 at 15:30):

alexcrichton opened issue #5583:

Given this input:

;;Output of `std::fmt::Debug`:

;; Compile test case

test compile
set opt_level=speed_and_size
set enable_alias_analysis=false
set enable_simd=true
set machine_code_cfg_info=true
set enable_jump_tables=false
set enable_heap_access_spectre_mitigation=false
set enable_table_access_spectre_mitigation=false
target riscv64

function u1:0(f64, f32, i32, i16, i8, i64, i128) system_v {
block0(v0: f64, v1: f32, v2: i32, v3: i16, v4: i8, v5: i64, v6: i128):
    v7 = iconst.i8 0
    v8 = iconst.i16 0
    v9 = iconst.i32 0
    v10 = iconst.i64 0
    v11 = uextend.i128 v10  ; v10 = 0
    v12 = ishl v4, v5
    v13 = icmp slt v3, v3
    v28 = fsub v1, v1
    v29 = fcmp ne v28, v28
    v30 = f32const +NaN
    v14 = select v29, v30, v28  ; v30 = +NaN
    v15 = select v13, v6, v6
    v31 = fsub v14, v14
    v32 = fcmp ne v31, v31
    v33 = f32const +NaN
    v16 = select v32, v33, v31  ; v33 = +NaN
    v34 = fsub v16, v16
    v35 = fcmp ne v34, v34
    v36 = f32const +NaN
    v17 = select v35, v36, v34  ; v36 = +NaN
    v37 = fsub v17, v17
    v38 = fcmp ne v37, v37
    v39 = f32const +NaN
    v18 = select v38, v39, v37  ; v39 = +NaN
    v40 = fsub v18, v18
    v41 = fcmp ne v40, v40
    v42 = f32const +NaN
    v19 = select v41, v42, v40  ; v42 = +NaN
    v20 = select v15, v5, v5
    v21 = smin v20, v20
    v22 = ishl v13, v21
    v43 = fsub v19, v19
    v44 = fcmp ne v43, v43
    v45 = f32const +NaN
    v23 = select v44, v45, v43  ; v45 = +NaN
    v46 = fsub v23, v23
    v47 = fcmp ne v46, v46
    v48 = f32const +NaN
    v24 = select v47, v48, v46  ; v48 = +NaN
    v55 = iconst.i8 0
    v56 = iconst.i8 1
    v57 = icmp eq v22, v55  ; v55 = 0
    v58 = select v57, v56, v22  ; v56 = 1
    v25 = udiv v22, v58
    v49 = fsub v24, v24
    v50 = fcmp ne v49, v49
    v51 = f32const +NaN
    v26 = select v50, v51, v49  ; v51 = +NaN
    v52 = fsub v26, v26
    v53 = fcmp ne v52, v52
    v54 = f32const +NaN
    v27 = select v53, v54, v52  ; v54 = +NaN
    return
}

the current backend panics with:

$ cargo run -q -p cranelift-tools test foo.clif
thread 'worker #0' panicked at 'called `Option::unwrap()` on a `None` value', cranelift/codegen/src/isa/riscv64/lower/isle.rs:53:5
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
 ERROR cranelift_filetests::concurrent > FAIL: panicked in worker #0: called `Option::unwrap()` on a `None` value
FAIL foo.clif: panicked in worker #0: called `Option::unwrap()` on a `None` value
1 tests
Error: 1 failure

view this post on Zulip Wasmtime GitHub notifications bot (Jan 17 2023 at 15:30):

alexcrichton labeled issue #5583:

Given this input:

;;Output of `std::fmt::Debug`:

;; Compile test case

test compile
set opt_level=speed_and_size
set enable_alias_analysis=false
set enable_simd=true
set machine_code_cfg_info=true
set enable_jump_tables=false
set enable_heap_access_spectre_mitigation=false
set enable_table_access_spectre_mitigation=false
target riscv64

function u1:0(f64, f32, i32, i16, i8, i64, i128) system_v {
block0(v0: f64, v1: f32, v2: i32, v3: i16, v4: i8, v5: i64, v6: i128):
    v7 = iconst.i8 0
    v8 = iconst.i16 0
    v9 = iconst.i32 0
    v10 = iconst.i64 0
    v11 = uextend.i128 v10  ; v10 = 0
    v12 = ishl v4, v5
    v13 = icmp slt v3, v3
    v28 = fsub v1, v1
    v29 = fcmp ne v28, v28
    v30 = f32const +NaN
    v14 = select v29, v30, v28  ; v30 = +NaN
    v15 = select v13, v6, v6
    v31 = fsub v14, v14
    v32 = fcmp ne v31, v31
    v33 = f32const +NaN
    v16 = select v32, v33, v31  ; v33 = +NaN
    v34 = fsub v16, v16
    v35 = fcmp ne v34, v34
    v36 = f32const +NaN
    v17 = select v35, v36, v34  ; v36 = +NaN
    v37 = fsub v17, v17
    v38 = fcmp ne v37, v37
    v39 = f32const +NaN
    v18 = select v38, v39, v37  ; v39 = +NaN
    v40 = fsub v18, v18
    v41 = fcmp ne v40, v40
    v42 = f32const +NaN
    v19 = select v41, v42, v40  ; v42 = +NaN
    v20 = select v15, v5, v5
    v21 = smin v20, v20
    v22 = ishl v13, v21
    v43 = fsub v19, v19
    v44 = fcmp ne v43, v43
    v45 = f32const +NaN
    v23 = select v44, v45, v43  ; v45 = +NaN
    v46 = fsub v23, v23
    v47 = fcmp ne v46, v46
    v48 = f32const +NaN
    v24 = select v47, v48, v46  ; v48 = +NaN
    v55 = iconst.i8 0
    v56 = iconst.i8 1
    v57 = icmp eq v22, v55  ; v55 = 0
    v58 = select v57, v56, v22  ; v56 = 1
    v25 = udiv v22, v58
    v49 = fsub v24, v24
    v50 = fcmp ne v49, v49
    v51 = f32const +NaN
    v26 = select v50, v51, v49  ; v51 = +NaN
    v52 = fsub v26, v26
    v53 = fcmp ne v52, v52
    v54 = f32const +NaN
    v27 = select v53, v54, v52  ; v54 = +NaN
    return
}

the current backend panics with:

$ cargo run -q -p cranelift-tools test foo.clif
thread 'worker #0' panicked at 'called `Option::unwrap()` on a `None` value', cranelift/codegen/src/isa/riscv64/lower/isle.rs:53:5
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
 ERROR cranelift_filetests::concurrent > FAIL: panicked in worker #0: called `Option::unwrap()` on a `None` value
FAIL foo.clif: panicked in worker #0: called `Option::unwrap()` on a `None` value
1 tests
Error: 1 failure

view this post on Zulip Wasmtime GitHub notifications bot (Jan 17 2023 at 15:30):

alexcrichton labeled issue #5583:

Given this input:

;;Output of `std::fmt::Debug`:

;; Compile test case

test compile
set opt_level=speed_and_size
set enable_alias_analysis=false
set enable_simd=true
set machine_code_cfg_info=true
set enable_jump_tables=false
set enable_heap_access_spectre_mitigation=false
set enable_table_access_spectre_mitigation=false
target riscv64

function u1:0(f64, f32, i32, i16, i8, i64, i128) system_v {
block0(v0: f64, v1: f32, v2: i32, v3: i16, v4: i8, v5: i64, v6: i128):
    v7 = iconst.i8 0
    v8 = iconst.i16 0
    v9 = iconst.i32 0
    v10 = iconst.i64 0
    v11 = uextend.i128 v10  ; v10 = 0
    v12 = ishl v4, v5
    v13 = icmp slt v3, v3
    v28 = fsub v1, v1
    v29 = fcmp ne v28, v28
    v30 = f32const +NaN
    v14 = select v29, v30, v28  ; v30 = +NaN
    v15 = select v13, v6, v6
    v31 = fsub v14, v14
    v32 = fcmp ne v31, v31
    v33 = f32const +NaN
    v16 = select v32, v33, v31  ; v33 = +NaN
    v34 = fsub v16, v16
    v35 = fcmp ne v34, v34
    v36 = f32const +NaN
    v17 = select v35, v36, v34  ; v36 = +NaN
    v37 = fsub v17, v17
    v38 = fcmp ne v37, v37
    v39 = f32const +NaN
    v18 = select v38, v39, v37  ; v39 = +NaN
    v40 = fsub v18, v18
    v41 = fcmp ne v40, v40
    v42 = f32const +NaN
    v19 = select v41, v42, v40  ; v42 = +NaN
    v20 = select v15, v5, v5
    v21 = smin v20, v20
    v22 = ishl v13, v21
    v43 = fsub v19, v19
    v44 = fcmp ne v43, v43
    v45 = f32const +NaN
    v23 = select v44, v45, v43  ; v45 = +NaN
    v46 = fsub v23, v23
    v47 = fcmp ne v46, v46
    v48 = f32const +NaN
    v24 = select v47, v48, v46  ; v48 = +NaN
    v55 = iconst.i8 0
    v56 = iconst.i8 1
    v57 = icmp eq v22, v55  ; v55 = 0
    v58 = select v57, v56, v22  ; v56 = 1
    v25 = udiv v22, v58
    v49 = fsub v24, v24
    v50 = fcmp ne v49, v49
    v51 = f32const +NaN
    v26 = select v50, v51, v49  ; v51 = +NaN
    v52 = fsub v26, v26
    v53 = fcmp ne v52, v52
    v54 = f32const +NaN
    v27 = select v53, v54, v52  ; v54 = +NaN
    return
}

the current backend panics with:

$ cargo run -q -p cranelift-tools test foo.clif
thread 'worker #0' panicked at 'called `Option::unwrap()` on a `None` value', cranelift/codegen/src/isa/riscv64/lower/isle.rs:53:5
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
 ERROR cranelift_filetests::concurrent > FAIL: panicked in worker #0: called `Option::unwrap()` on a `None` value
FAIL foo.clif: panicked in worker #0: called `Option::unwrap()` on a `None` value
1 tests
Error: 1 failure

view this post on Zulip Wasmtime GitHub notifications bot (Jan 17 2023 at 16:06):

afonso360 commented on issue #5583:

Here's a minimized test case:

test compile
target riscv64

function u1:0() system_v {
block0:
    v3 = iconst.i16 0
    v5 = iconst.i64 0
    v6 = uextend.i128 v5  ; v5 = 0
    v13 = icmp slt v3, v3  ; v3 = 0, v3 = 0
    v15 = select v13, v6, v6
    v20 = select v15, v5, v5  ; v5 = 0, v5 = 0
    v22 = ishl v13, v20
    v58 = iconst.i8 0
    v25 = udiv v22, v58  ; v58 = 0
    return
}

This is crashing in this rule but for some reason removing the udiv instruction makes it stop crashing.

The actual reason for the crash is that we are calling put_in_reg with a i128 value.

view this post on Zulip Wasmtime GitHub notifications bot (Jan 17 2023 at 18:01):

fitzgen closed issue #5583:

Given this input:

;;Output of `std::fmt::Debug`:

;; Compile test case

test compile
set opt_level=speed_and_size
set enable_alias_analysis=false
set enable_simd=true
set machine_code_cfg_info=true
set enable_jump_tables=false
set enable_heap_access_spectre_mitigation=false
set enable_table_access_spectre_mitigation=false
target riscv64

function u1:0(f64, f32, i32, i16, i8, i64, i128) system_v {
block0(v0: f64, v1: f32, v2: i32, v3: i16, v4: i8, v5: i64, v6: i128):
    v7 = iconst.i8 0
    v8 = iconst.i16 0
    v9 = iconst.i32 0
    v10 = iconst.i64 0
    v11 = uextend.i128 v10  ; v10 = 0
    v12 = ishl v4, v5
    v13 = icmp slt v3, v3
    v28 = fsub v1, v1
    v29 = fcmp ne v28, v28
    v30 = f32const +NaN
    v14 = select v29, v30, v28  ; v30 = +NaN
    v15 = select v13, v6, v6
    v31 = fsub v14, v14
    v32 = fcmp ne v31, v31
    v33 = f32const +NaN
    v16 = select v32, v33, v31  ; v33 = +NaN
    v34 = fsub v16, v16
    v35 = fcmp ne v34, v34
    v36 = f32const +NaN
    v17 = select v35, v36, v34  ; v36 = +NaN
    v37 = fsub v17, v17
    v38 = fcmp ne v37, v37
    v39 = f32const +NaN
    v18 = select v38, v39, v37  ; v39 = +NaN
    v40 = fsub v18, v18
    v41 = fcmp ne v40, v40
    v42 = f32const +NaN
    v19 = select v41, v42, v40  ; v42 = +NaN
    v20 = select v15, v5, v5
    v21 = smin v20, v20
    v22 = ishl v13, v21
    v43 = fsub v19, v19
    v44 = fcmp ne v43, v43
    v45 = f32const +NaN
    v23 = select v44, v45, v43  ; v45 = +NaN
    v46 = fsub v23, v23
    v47 = fcmp ne v46, v46
    v48 = f32const +NaN
    v24 = select v47, v48, v46  ; v48 = +NaN
    v55 = iconst.i8 0
    v56 = iconst.i8 1
    v57 = icmp eq v22, v55  ; v55 = 0
    v58 = select v57, v56, v22  ; v56 = 1
    v25 = udiv v22, v58
    v49 = fsub v24, v24
    v50 = fcmp ne v49, v49
    v51 = f32const +NaN
    v26 = select v50, v51, v49  ; v51 = +NaN
    v52 = fsub v26, v26
    v53 = fcmp ne v52, v52
    v54 = f32const +NaN
    v27 = select v53, v54, v52  ; v54 = +NaN
    return
}

the current backend panics with:

$ cargo run -q -p cranelift-tools test foo.clif
thread 'worker #0' panicked at 'called `Option::unwrap()` on a `None` value', cranelift/codegen/src/isa/riscv64/lower/isle.rs:53:5
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
 ERROR cranelift_filetests::concurrent > FAIL: panicked in worker #0: called `Option::unwrap()` on a `None` value
FAIL foo.clif: panicked in worker #0: called `Option::unwrap()` on a `None` value
1 tests
Error: 1 failure

Last updated: Dec 23 2024 at 12:05 UTC