Skip to content

Fix lowering issue in x64 vany_true: sinking and using original value.#4815

Merged
cfallin merged 1 commit intobytecodealliance:mainfrom
cfallin:fix-4807-fuzzbug
Aug 30, 2022
Merged

Fix lowering issue in x64 vany_true: sinking and using original value.#4815
cfallin merged 1 commit intobytecodealliance:mainfrom
cfallin:fix-4807-fuzzbug

Conversation

@cfallin
Copy link
Member

@cfallin cfallin commented Aug 30, 2022

The x64 lowring of vany_true both sinks mergeable loads and uses the
original register. This PR fixes the lowering to force the value into a
register first. Ideally we should solve the issue by catching this in
the ISLE type system, as described in #4745, but this resolves the issue
for now.

Fixes #4807.

The x64 lowring of `vany_true` both sinks mergeable loads and uses the
original register. This PR fixes the lowering to force the value into a
register first. Ideally we should solve the issue by catching this in
the ISLE type system, as described in bytecodealliance#4745, but this resolves the issue
for now.

Fixes bytecodealliance#4807.
@cfallin cfallin requested a review from elliottt August 30, 2022 03:44
@github-actions github-actions bot added cranelift Issues related to the Cranelift code generator cranelift:area:x64 Issues related to x64 codegen labels Aug 30, 2022
Copy link
Member

@elliottt elliottt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for catching this!

@cfallin cfallin merged commit b1fb4d7 into bytecodealliance:main Aug 30, 2022
@cfallin cfallin deleted the fix-4807-fuzzbug branch August 30, 2022 05:22
alexcrichton added a commit to alexcrichton/wasmtime that referenced this pull request Aug 19, 2024
This commit fixes an issue where a `Value` was both load-sunk and used
as-is, meaning it was both sunk and not. That triggered a panic in the
backend since this isn't valid. The reason for this is due to how some
ISLE rules were written where a `Value` was both implicitly coerced into
an `XmmMem` and an `Xmm`. This issue is similar to bytecodealliance#4815 for example.
The fix in this commit is to force the operands into registers which
prevents load sinking which wouldn't work here anyway.

This panic was introduced in bytecodealliance#5841 which is quite old at this point.
This bug does not affect WebAssembly translation due to how the `v128`
type maps to `i8x16` in Cranelift by default.

Closes bytecodealliance#9143
github-merge-queue bot pushed a commit that referenced this pull request Aug 19, 2024
This commit fixes an issue where a `Value` was both load-sunk and used
as-is, meaning it was both sunk and not. That triggered a panic in the
backend since this isn't valid. The reason for this is due to how some
ISLE rules were written where a `Value` was both implicitly coerced into
an `XmmMem` and an `Xmm`. This issue is similar to #4815 for example.
The fix in this commit is to force the operands into registers which
prevents load sinking which wouldn't work here anyway.

This panic was introduced in #5841 which is quite old at this point.
This bug does not affect WebAssembly translation due to how the `v128`
type maps to `i8x16` in Cranelift by default.

Closes #9143
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cranelift:area:x64 Issues related to x64 codegen cranelift Issues related to the Cranelift code generator

Projects

None yet

Development

Successfully merging this pull request may close these issues.

instantiate fuzzbug: Using a sunk load's result in a register

2 participants