Stream: git-wasmtime

Topic: wasmtime / issue #5690 Cranelift panics on a shift with o...

Wasmtime GitHub notifications bot (Feb 02 2023 at 15:43):

alexcrichton opened issue #5690:

Given:

;;Output of `std::fmt::Debug`:

;; Fuzzgen test case

test interpret
test run
set opt_level=speed
set enable_simd=true
set enable_safepoints=true
set unwind_info=false
set preserve_frame_pointers=true
set machine_code_cfg_info=true
set enable_table_access_spectre_mitigation=false
target aarch64
function %u1() -> i64 sext, f64, i8, i8 sext, i8 sext system_v {
block0:
    v0 = f64const 0x1.8373638ff3738p-124
    v1 = iconst.i8 53
    v2 = iconst.i64 0x4445_00ff_ffff_ffff
    v3 = iconst.i8 0
    v4 = iconst.i16 0
    v5 = iconst.i32 0
    v6 = iconst.i64 0
    v7 = uextend.i128 v6  ; v6 = 0
    v8 = ishl v2, v2  ; v2 = 0x4445_00ff_ffff_ffff, v2 = 0x4445_00ff_ffff_ffff
    v9 = rotr v1, v1  ; v1 = 53, v1 = 53
    nop
    return v8, v0, v9, v9, v9  ; v0 = 0x1.8373638ff3738p-124
}

; Note: the results in the below test cases are simply a placeholder and probably will be wrong

; run: %u1() == [-9223372036854775808, 0x1.8373638ff3738p-124, -87, -87, -87]

this yields:

$ cargo run -q test ../out.log
thread 'worker #0' panicked at 'attempt to shift left with overflow', cranelift/codegen/src/opts.rs:89:5
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
 ERROR cranelift_filetests::concurrent > FAIL: panicked in worker #0: attempt to shift left with overflow
FAIL ../out.log: panicked in worker #0: attempt to shift left with overflow
1 tests
Error: 1 failure

cc @fitzgen as this was found trying to reduce the fuzz test failure from https://github.com/bytecodealliance/wasmtime/issues/5689

Wasmtime GitHub notifications bot (Feb 02 2023 at 15:43):

alexcrichton labeled issue #5690:

Given:

;;Output of `std::fmt::Debug`:

;; Fuzzgen test case

test interpret
test run
set opt_level=speed
set enable_simd=true
set enable_safepoints=true
set unwind_info=false
set preserve_frame_pointers=true
set machine_code_cfg_info=true
set enable_table_access_spectre_mitigation=false
target aarch64
function %u1() -> i64 sext, f64, i8, i8 sext, i8 sext system_v {
block0:
    v0 = f64const 0x1.8373638ff3738p-124
    v1 = iconst.i8 53
    v2 = iconst.i64 0x4445_00ff_ffff_ffff
    v3 = iconst.i8 0
    v4 = iconst.i16 0
    v5 = iconst.i32 0
    v6 = iconst.i64 0
    v7 = uextend.i128 v6  ; v6 = 0
    v8 = ishl v2, v2  ; v2 = 0x4445_00ff_ffff_ffff, v2 = 0x4445_00ff_ffff_ffff
    v9 = rotr v1, v1  ; v1 = 53, v1 = 53
    nop
    return v8, v0, v9, v9, v9  ; v0 = 0x1.8373638ff3738p-124
}

; Note: the results in the below test cases are simply a placeholder and probably will be wrong

; run: %u1() == [-9223372036854775808, 0x1.8373638ff3738p-124, -87, -87, -87]

this yields:

$ cargo run -q test ../out.log
thread 'worker #0' panicked at 'attempt to shift left with overflow', cranelift/codegen/src/opts.rs:89:5
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
 ERROR cranelift_filetests::concurrent > FAIL: panicked in worker #0: attempt to shift left with overflow
FAIL ../out.log: panicked in worker #0: attempt to shift left with overflow
1 tests
Error: 1 failure

cc @fitzgen as this was found trying to reduce the fuzz test failure from https://github.com/bytecodealliance/wasmtime/issues/5689

Wasmtime GitHub notifications bot (Feb 02 2023 at 17:03):

jameysharp commented on issue #5690:

This should be easy to fix: I assume it's in the u64_shl helper, and I think it probably should be using wrapping_shl.

Wasmtime GitHub notifications bot (Feb 02 2023 at 17:04):

jameysharp edited a comment on issue #5690:

This should be easy to fix: I assume it's in the u64_shl helper, and I think it probably should be using wrapping_shl. Or maybe the const-prop rule needs to mask the shift amount according to the LHS type?

Wasmtime GitHub notifications bot (Feb 02 2023 at 20:54):

fitzgen commented on issue #5690:

I'm on it.

Wasmtime GitHub notifications bot (Feb 03 2023 at 00:13):

fitzgen closed issue #5690:

Given:

;;Output of `std::fmt::Debug`:

;; Fuzzgen test case

test interpret
test run
set opt_level=speed
set enable_simd=true
set enable_safepoints=true
set unwind_info=false
set preserve_frame_pointers=true
set machine_code_cfg_info=true
set enable_table_access_spectre_mitigation=false
target aarch64
function %u1() -> i64 sext, f64, i8, i8 sext, i8 sext system_v {
block0:
    v0 = f64const 0x1.8373638ff3738p-124
    v1 = iconst.i8 53
    v2 = iconst.i64 0x4445_00ff_ffff_ffff
    v3 = iconst.i8 0
    v4 = iconst.i16 0
    v5 = iconst.i32 0
    v6 = iconst.i64 0
    v7 = uextend.i128 v6  ; v6 = 0
    v8 = ishl v2, v2  ; v2 = 0x4445_00ff_ffff_ffff, v2 = 0x4445_00ff_ffff_ffff
    v9 = rotr v1, v1  ; v1 = 53, v1 = 53
    nop
    return v8, v0, v9, v9, v9  ; v0 = 0x1.8373638ff3738p-124
}

; Note: the results in the below test cases are simply a placeholder and probably will be wrong

; run: %u1() == [-9223372036854775808, 0x1.8373638ff3738p-124, -87, -87, -87]

this yields:

$ cargo run -q test ../out.log
thread 'worker #0' panicked at 'attempt to shift left with overflow', cranelift/codegen/src/opts.rs:89:5
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
 ERROR cranelift_filetests::concurrent > FAIL: panicked in worker #0: attempt to shift left with overflow
FAIL ../out.log: panicked in worker #0: attempt to shift left with overflow
1 tests
Error: 1 failure

cc @fitzgen as this was found trying to reduce the fuzz test failure from https://github.com/bytecodealliance/wasmtime/issues/5689

Last updated: Nov 22 2024 at 16:03 UTC