Stream: git-wasmtime

Topic: wasmtime / issue #8132 Cranelift: s390x wrong execution o...

Wasmtime GitHub notifications bot (Mar 14 2024 at 15:36):

candymate added the bug label to Issue #8132.

Wasmtime GitHub notifications bot (Mar 14 2024 at 15:36):

candymate added the cranelift label to Issue #8132.

Wasmtime GitHub notifications bot (Mar 14 2024 at 15:36):

candymate opened issue #8132:

Test Case

// main.rs
use wasmtime::*;

fn main() -> Result<()> {
    let mut config = Config::default();
    config.strategy(Strategy::Cranelift);
    config.cranelift_opt_level(OptLevel::None);

    let engine = Engine::new(&config)?;
    let wat = r#"
    (module
        (type (;0;) (func (param v128 v128 v128 v128 v128 v128 v128 v128 v128) (result v128)))
        (import "mem" "mem" (memory (;0;) 1))
        (func (;0;) (type 0) (param v128 v128 v128 v128 v128 v128 v128 v128 v128) (result v128)
          local.get 5
          local.get 8
          i16x8.extmul_high_i8x16_s)
        (export "main" (func 0)))
    "#;
    let module = Module::new(&engine, wat)?;
    let mut store = Store::new(&engine, ());

    let memory_ty = MemoryType::new(1, None);
    let memory = Memory::new(&mut store, memory_ty.clone())?;

    let instance = Instance::new(&mut store, &module, &[memory.into()])?;
    let main = instance.get_func(&mut store, "main")
        .expect("`main` was not an exported function");
    let params = vec![
        Val::V128(0.into()), // this is unused, but needed
        Val::V128(0.into()), // this is unused, but needed
        Val::V128(0.into()), // this is unused, but needed
        Val::V128(0.into()), // this is unused, but needed
        Val::V128(0.into()), // this is unused, but needed
        Val::V128(0xfffefdfccccdcecf807f7e7d00010203.into()),
        Val::V128(0.into()), // not sure why - this is unused, but needed
        Val::V128(0.into()), // not sure why - this is unused, but needed
        Val::V128(0x1e33ad29b5b0951d3c5c954764cd108d.into())
    ];
    let mut results = vec![Val::V128(0.into())];
    println!("Opt level None: {:?}", main.call(
        &mut store,
        &params,
        &mut results
    ));
    println!("{:?}", results);

    Ok(())
}

[package]
name = "wasmtime-wrapper"
version = "0.1.0"
edition = "2021"

# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

[dependencies]
# wasmtime = "18.0.3"
wasmtime = { path = "../wasmtime/crates/wasmtime" } # commit: 5a342c8b8610dfda97810ad0e9ec4f481aeb908a (current latest, Date:   Wed Mar 13 16:59:43 2024 -0700)

Steps to reproduce

Compare the following executions:

cargo run --release
cargo run --release --target=s390x-unknown-linux-gnu

QEMU run options (s390x) I'm currently using is the following:

qemu-s390x -L /usr/s390x-linux-gnu -E LD_LIBRARY_PATH=/usr/s390x-linux-gnu/lib -E WASMTIME_TEST_NO_HOG_MEMORY=1 target/s390x-unknown-linux-gnu/release/wasmtime-wrapper

Expected Results

S390X result should be the value 0xffe2ff9a00f9ff5c0f3c0ff014e6fa73

Opt level None: Ok(())
[V128(340131782231070605437920187635036781171)]

Actual Results

Execution results in a wrong value 0x73ffe00099fe70f1941551ee08f484

Opt level None: Ok(())
[V128(602303900475006763381319891191133316)]

Versions and Environment

• wasmtime version
  • commit: 5a342c8b8610dfda97810ad0e9ec4f481aeb908a (current latest, Date: Wed Mar 13 16:59:43 2024 -0700)
  • However, also checked on v18.0.3
• Operating system & architecture: Ubuntu 22.04.3 LTS, Arch: x86_64
• QEMU version: qemu-s390x version 8.2.1 (v8.2.1)

Extra Info

• The arguments that are unused are needed to expose the semantic difference
• Does not work on other architectures (x86_64, aarch64, riscv64)
• Uploading as public (not a security vuln.) since the target is not tier 1 (referring to https://docs.wasmtime.dev/security-what-is-considered-a-security-vulnerability.html as @fitzgen informed me in #8131)

Wasmtime GitHub notifications bot (Mar 14 2024 at 15:44):

fitzgen commented on issue #8132:

CC @uweigand

Wasmtime GitHub notifications bot (Mar 14 2024 at 15:44):

fitzgen added the cranelift:area:s390x label to Issue #8132.

Wasmtime GitHub notifications bot (Mar 14 2024 at 15:54):

alexcrichton added the fuzz-bug label to Issue #8132.

Wasmtime GitHub notifications bot (Mar 14 2024 at 18:44):

cfallin closed issue #8132:

Test Case

// main.rs
use wasmtime::*;

fn main() -> Result<()> {
    let mut config = Config::default();
    config.strategy(Strategy::Cranelift);
    config.cranelift_opt_level(OptLevel::None);

    let engine = Engine::new(&config)?;
    let wat = r#"
    (module
        (type (;0;) (func (param v128 v128 v128 v128 v128 v128 v128 v128 v128) (result v128)))
        (import "mem" "mem" (memory (;0;) 1))
        (func (;0;) (type 0) (param v128 v128 v128 v128 v128 v128 v128 v128 v128) (result v128)
          local.get 5
          local.get 8
          i16x8.extmul_high_i8x16_s)
        (export "main" (func 0)))
    "#;
    let module = Module::new(&engine, wat)?;
    let mut store = Store::new(&engine, ());

    let memory_ty = MemoryType::new(1, None);
    let memory = Memory::new(&mut store, memory_ty.clone())?;

    let instance = Instance::new(&mut store, &module, &[memory.into()])?;
    let main = instance.get_func(&mut store, "main")
        .expect("`main` was not an exported function");
    let params = vec![
        Val::V128(0.into()), // this is unused, but needed
        Val::V128(0.into()), // this is unused, but needed
        Val::V128(0.into()), // this is unused, but needed
        Val::V128(0.into()), // this is unused, but needed
        Val::V128(0.into()), // this is unused, but needed
        Val::V128(0xfffefdfccccdcecf807f7e7d00010203.into()),
        Val::V128(0.into()), // not sure why - this is unused, but needed
        Val::V128(0.into()), // not sure why - this is unused, but needed
        Val::V128(0x1e33ad29b5b0951d3c5c954764cd108d.into())
    ];
    let mut results = vec![Val::V128(0.into())];
    println!("Opt level None: {:?}", main.call(
        &mut store,
        &params,
        &mut results
    ));
    println!("{:?}", results);

    Ok(())
}

[package]
name = "wasmtime-wrapper"
version = "0.1.0"
edition = "2021"

# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

[dependencies]
# wasmtime = "18.0.3"
wasmtime = { path = "../wasmtime/crates/wasmtime" } # commit: 5a342c8b8610dfda97810ad0e9ec4f481aeb908a (current latest, Date:   Wed Mar 13 16:59:43 2024 -0700)

Steps to reproduce

Compare the following executions:

cargo run --release
cargo run --release --target=s390x-unknown-linux-gnu

QEMU run options (s390x) I'm currently using is the following:

qemu-s390x -L /usr/s390x-linux-gnu -E LD_LIBRARY_PATH=/usr/s390x-linux-gnu/lib -E WASMTIME_TEST_NO_HOG_MEMORY=1 target/s390x-unknown-linux-gnu/release/wasmtime-wrapper

Expected Results

S390X result should be the value 0xffe2ff9a00f9ff5c0f3c0ff014e6fa73

Opt level None: Ok(())
[V128(340131782231070605437920187635036781171)]

Actual Results

Execution results in a wrong value 0x73ffe00099fe70f1941551ee08f484

Opt level None: Ok(())
[V128(602303900475006763381319891191133316)]

Versions and Environment

• wasmtime version
  • commit: 5a342c8b8610dfda97810ad0e9ec4f481aeb908a (current latest, Date: Wed Mar 13 16:59:43 2024 -0700)
  • However, also checked on v18.0.3
• Operating system & architecture: Ubuntu 22.04.3 LTS, Arch: x86_64
• QEMU version: qemu-s390x version 8.2.1 (v8.2.1)

Extra Info

• The arguments that are unused are needed to expose the semantic difference
• Does not work on other architectures (x86_64, aarch64, riscv64)
• Uploading as public (not a security vuln.) since the target is not tier 1 (referring to https://docs.wasmtime.dev/security-what-is-considered-a-security-vulnerability.html as @fitzgen informed me in #8131)

Last updated: Nov 22 2024 at 17:03 UTC