LLVM-compiled Wasm code produces incorrect result

[HeliosPanoptes]

Describe the bug

wasmer 1.0.2 | rustc 1.51.0-nightly (04caa632d 2021-01-30) | x86_64

wat2wasm 1.0.13

Using the llvm compiler can result in a mis-compiled module that produces the wrong result.

(module
  (func $main (result i32)
    i32.const 235
    i32.const -123
    f32.const -1
    f32.const 0
    f32.lt
    i32.rem_u
    i32.rotl)
  (export "_main" (func $main)))

The above Wasm code when compiled and run using LLVM will produce -1, when the expected answer is 235. When the code is compiled and run using Cranelift, the output is as expected.

Steps to reproduce

wasmer_bug.zip

1. Unzip and go to the root level of the zip file.
2. Run cargo run ./src/wasmer_bug_minimal.wasm
3. See that the two compilers produce different results.

Expected behavior

That both the Cranelift-compiled and LLVM-compiled Wasm modules produce the same output.

Actual behavior

The LLVM-compiled module produces -1 as its output, while the Cranelift-compiled module produces 235.

Additional context

None.

[nlewycky]

Further reduced:

(module
  (func $main (result i32)
    i32.const 235
    i32.const 0
    i32.rotl
  )
  (export "_main" (func $main)))
$ wasmer --llvm test2143.wat -i _main
-1

This is a great bug. LLVM doesn't have a rotate instruction, so we implement it in a few steps with temporary values:

  a = value <<u amt
  b = value >>u (bitwidth - amt)
  c = a | b

where <<u and >>u are "unsigned" or "logical" shifts. However, LLVM defines that shift-right only has defined behaviour if the amount to shift by is from 0..bitwidth-1. When the amount is zero, computing b will attempt to shift by 32 which is not permitted in LLVM IR.